CVE-2026-3746

5.5 mediumEPSS 0.4%

Medium (5.5) in oretnom23 simple responsive tourism website. EPSS 0.4% chance of exploitation in the next 30 days.

A vulnerability was determined in SourceCodester Simple Responsive Tourism Website 1.0. Affected by this vulnerability is an unknown functionality of the file /tourism/classes/Login.php?f=login of the component Login. This manipulation of the argument Username causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.

Severity

CVSS 4.0

5.5 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 33% of CVEs (scores of 2026-10-31)
CWEs: CWE-74, CWE-89
Published: 2026-03-08
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

oretnom23:simple_responsive_tourism_website

References

https://github.com/CH0ico/CVE_choco_7
https://github.com/CH0ico/CVE_choco_7/blob/main/report.md
https://vuldb.com/?ctiid.349724
https://vuldb.com/?id.349724
https://vuldb.com/?submit.767882

Check your stack JSON