The vulnerability CVE-2026-14688 affects itsourcecode Online Hotel Management System version 1.0. It is an SQL injection flaw located in an unspecified function in the /admin/login.php file. The attack vector is the email argument, which is improperly sanitized, allowing remote attackers to inject SQL commands. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. There is no known official fix or patch available at this time, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access, modification, or deletion with limited confidentiality, integrity, and availability impact as per the CVSS vector. The vulnerability affects the login functionality, potentially compromising authentication mechanisms.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing web application firewalls (WAFs) or input validation controls to mitigate SQL injection risks on the email parameter in /admin/login.php. Monitor vendor channels for updates.