CVE-2026-3746
Published: 08 March 2026
Summary
CVE-2026-3746 is a medium-severity Injection (CWE-74) vulnerability in Oretnom23 Simple Responsive Tourism Website. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 29.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2026-3746 is a SQL injection vulnerability (CWE-74, CWE-89) in SourceCodester Simple Responsive Tourism Website 1.0, published on 2026-03-08. It affects an unknown functionality in the file /tourism/classes/Login.php?f=login within the Login component, where manipulation of the Username argument enables the injection.
The vulnerability is remotely exploitable by unauthenticated attackers requiring low complexity and no user interaction, per its CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Exploitation can result in limited impacts to confidentiality, integrity, and availability. The exploit has been publicly disclosed and may be utilized.
Advisories and additional details, including exploit information, are available in referenced sources such as the GitHub repository at https://github.com/CH0ico/CVE_choco_7 and report at https://github.com/CH0ico/CVE_choco_7/blob/main/report.md, along with VulDB entries at https://vuldb.com/?ctiid.349724, https://vuldb.com/?id.349724, and https://vuldb.com/?submit.767882.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-10249
Vulnerability details
A vulnerability was determined in SourceCodester Simple Responsive Tourism Website 1.0. Affected by this vulnerability is an unknown functionality of the file /tourism/classes/Login.php?f=login of the component Login. This manipulation of the argument Username causes sql injection. The attack may be…
more
initiated remotely. The exploit has been publicly disclosed and may be utilized.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in a remotely accessible web login endpoint (public-facing application) directly enables the T1190 technique for initial access with no authentication required.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of untrusted inputs such as the Username argument before it reaches the SQL query in Login.php.
Enforces that only properly authenticated subjects can access protected functions, blocking the SQLi bypass of the login check.
Enables monitoring and anomaly detection on login attempts that contain SQL syntax or unusual query patterns indicative of this attack.