The vulnerability CVE-2026-13555 affects itsourcecode Online Hotel Management System version 1.0. It is a SQL injection flaw in the /admin/mod_users/controller.php?action=add endpoint, where the Name parameter is not properly sanitized, allowing remote attackers to inject SQL commands. This can lead to unauthorized database queries or data manipulation. The exploit has been made public, increasing the risk of exploitation. No official patch or remediation guidance is currently available from the vendor.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access, data modification, or other database impacts. The vulnerability is remotely exploitable without authentication and requires no user interaction. The CVSS 4.0 score of 6.9 indicates a medium severity impact with low complexity and no privileges required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to implement input validation and sanitization on the Name parameter in the affected endpoint to mitigate injection risks. Monitoring for unusual database queries and restricting database permissions may also help reduce impact.