The vulnerability CVE-2026-14756 exists in code-projects Hotel and Tourism Reservation 1.0 within the Tour Management Page's /admin/add_tour.php file. An attacker can exploit improper input validation on the delete_image parameter to perform SQL injection attacks remotely without any privileges or user interaction. This could allow partial compromise of the database confidentiality, integrity, and availability. The vulnerability has been publicly disclosed, but no vendor-provided fix or mitigation is documented at this time.

Successful exploitation of this SQL injection vulnerability can lead to unauthorized access to or modification of database contents related to the affected application. The CVSS vector indicates low to limited impact on confidentiality, integrity, and availability, but the attack requires no privileges or user interaction and can be performed remotely. There is no evidence of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected component and monitor for suspicious activity related to the delete_image parameter. Avoid exposing the vulnerable interface publicly if possible.