CVE-2026-10288

🗓️ 01 Jun 2026 20:00:11Reported by VulDBType

cve🔗 web.nvd.nist.gov👁 23 Views🌐 WEB

Remote authentication bypass in Hotel and Tourism Reservation System via password_verify in admin.

Reporter	Title	Published	Views	Family All 9
ATTACKERKB	CVE-2026-10288	1 Jun 202620:00	–	attackerkb
Circl	CVE-2026-10288	1 Jun 202621:24	–	circl
CNNVD	Code-Projects Hotel and Tourism Reservation System 授权问题漏洞	1 Jun 202600:00	–	cnnvd
Cvelist	CVE-2026-10288 code-projects Hotel and Tourism Reservation System Admin Login login.php password_verify improper authentication	1 Jun 202620:00	–	cvelist
EUVD	EUVD-2026-33762	1 Jun 202620:00	–	euvd
NVD	CVE-2026-10288	1 Jun 202621:16	–	nvd
Positive Technologies	PT-2026-45553	1 Jun 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-10288	5 Jun 202619:34	–	redhatcve
Vulnrichment	CVE-2026-10288 code-projects Hotel and Tourism Reservation System Admin Login login.php password_verify improper authentication	1 Jun 202620:00	–	vulnrichment

Vulners

Node

code-projects hotel_and_tourism_reservation_systemMatch1.0

[
  {
    "vendor": "code-projects",
    "product": "Hotel and Tourism Reservation System",
    "versions": [
      {
        "version": "1.0",
        "status": "affected"
      }
    ],
    "cpes": [
      "cpe:2.3:a:code-projects:hotel_and_tourism_reservation_system:*:*:*:*:*:*:*:*"
    ],
    "modules": [
      "Admin Login"
    ]
  }
]

Source	Link
vuldb	www.vuldb.com/vuln/367581/cti
vuldb	www.vuldb.com/cve/CVE-2026-10288
code-projects	www.code-projects.org/
github	www.github.com/Xmyronn/Hotel-and-Tourism-Reservation-System---Authentication-Bypass.git
vuldb	www.vuldb.com/submit/825786
vuldb	www.vuldb.com/vuln/367581

Parameter	Position	Path	Description	CWE
Password	request body	/admin/login.php	Manipulation of the password argument in the login flow leads to improper authentication (authentication bypass).	CWE-287

17 Jun 2026 10:12Current

5.6Medium risk

Vulners AI Score5.6

CVSS 46.9

CVSS 3.17.3

CVSS 27.5

CVSS 37.3

EPSS0.00496

SSVC

CWE-287