The vulnerability CVE-2026-14754 affects code-projects Hotel and Tourism Reservation version 1.0. It is a SQL injection flaw located in an unknown function of the /admin/add_room.php file. Attackers can manipulate parameters such as delete_image, edit, description, number, price, rooms, or type to inject SQL commands. The vulnerability is remotely exploitable without requiring privileges or user interaction. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges required, no user interaction, and low impact on confidentiality, integrity, and availability. No vendor remediation or patch information is provided, and no known exploits in the wild have been reported.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access or modification. The impact is rated medium based on the CVSS 4.0 score of 6.9, reflecting limited but significant confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to restrict access to the /admin/add_room.php functionality to trusted users only and implement web application firewall (WAF) rules to detect and block SQL injection attempts targeting the affected parameters.