The vulnerability CVE-2026-14754 affects code-projects Hotel and Tourism Reservation 1.0. It is a SQL injection flaw located in an unspecified function in the /admin/add_room.php file. Attackers can manipulate parameters such as delete_image, edit, description, number, price, rooms, or type to execute SQL injection attacks remotely without any privileges or user interaction. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity). Although an exploit has been published, there is no vendor-provided remediation or patch available at this time.

Successful exploitation of this SQL injection vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access, modification, or deletion, potentially compromising the confidentiality and integrity of the application data. The vulnerability does not require user interaction or privileges to exploit but has limited scope and impact as indicated by the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently available, users should consider applying web application firewall (WAF) rules to detect and block SQL injection attempts targeting the affected parameters. Restricting access to the /admin/add_room.php endpoint to trusted administrators and monitoring for suspicious activity may also help mitigate risk until a patch is released.