CVE-2026-3746
Published: 08 March 2026
Summary
CVE-2026-3746 is a high-severity Injection (CWE-74) vulnerability in Oretnom23 Simple Responsive Tourism Website. Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 21.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Threat & Defense at a Glance
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing uses SQL injection payloads against database interfaces, identifying and supporting fixes for SQL injection weaknesses.
Developer assessments and testing (including injection-focused techniques) identify improper neutralization of special elements, and the verifiable flaw remediation corrects them pre-deployment.
Validates query inputs to prevent SQL syntax or command manipulation.
Identifies indicators of injection attacks (command, SQL, LDAP, etc.) via anomaly and attack monitoring.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in a remotely accessible web login endpoint (public-facing application) directly enables the T1190 technique for initial access with no authentication required.
NVD Description
A vulnerability was determined in SourceCodester Simple Responsive Tourism Website 1.0. Affected by this vulnerability is an unknown functionality of the file /tourism/classes/Login.php?f=login of the component Login. This manipulation of the argument Username causes sql injection. The attack may be…
more
initiated remotely. The exploit has been publicly disclosed and may be utilized.
Deeper analysisAI
CVE-2026-3746 is a SQL injection vulnerability (CWE-74, CWE-89) in SourceCodester Simple Responsive Tourism Website 1.0, published on 2026-03-08. It affects an unknown functionality in the file /tourism/classes/Login.php?f=login within the Login component, where manipulation of the Username argument enables the injection.
The vulnerability is remotely exploitable by unauthenticated attackers requiring low complexity and no user interaction, per its CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Exploitation can result in limited impacts to confidentiality, integrity, and availability. The exploit has been publicly disclosed and may be utilized.
Advisories and additional details, including exploit information, are available in referenced sources such as the GitHub repository at https://github.com/CH0ico/CVE_choco_7 and report at https://github.com/CH0ico/CVE_choco_7/blob/main/report.md, along with VulDB entries at https://vuldb.com/?ctiid.349724, https://vuldb.com/?id.349724, and https://vuldb.com/?submit.767882.
Details
- CWE(s)