CVE-2020-21012

Sourcecodester Hotel and Lodge Management System 2.0 is vulnerable to unauthenticated SQL injection and can allow remote attackers to execute arbitrary SQL commands via the email parameter to the edit page for Customer, Room, Currency, Room Booking Details, or Tax Details.

CVSS 3.1

9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

3.5% chance of exploitation in the next 30 days; higher than 89% of CVEs (scores of 2026-10-25)

CWE

CWE-89

Published

2021-10-01

Modified

2026-10-22

Record from

the NVD, synced 2026-10-22

Affected

• nikhil-bhalerao:hotel_and_lodge_management_system

References

• https://github.com/hitIer/web_test/tree/master/hotel
• https://github.com/hitIer/web_test/tree/master/hotel

Check your stackJSON