PT-2026-46837

CVE-2026-10877

Published

2026-06-04

Updated

2026-06-21

Description by

CVSS 2.0

7.5

High

MetricsAV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SourceCodester Ship Ferry Ticket Reservation System versions prior to 1.1

Description An issue exists in the Admin Login component within the '/admin/login.php' endpoint. Remote manipulation of the Username argument allows for SQL injection, a technique where malicious SQL statements are inserted into entry fields for execution.

Recommendations Update the system to a version later than 1.0. As a temporary workaround, restrict access to the '/admin/login.php' endpoint to minimize the risk of exploitation.

Exploitability

Exploit

Fix

Impacts

Researchers

Hemantra J Bhati

Hemantrajbhati5555

Vendors

Affected products

Weakness enumeration

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\'Injection\')

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')