CVE-2026-36938 identifies an SQL injection vulnerability in Sourcecodester Online Resort Management System v1.0, specifically in the /orms/admin/rooms/view_room.php endpoint. This vulnerability arises from improper input sanitization, allowing attackers to inject malicious SQL code. The CVE entry does not provide a CVSS score or detailed impact metrics, nor does it include vendor advisories or patch information. Exploitation could lead to unauthorized database queries, but no active exploitation has been reported.

Successful exploitation of this SQL injection vulnerability could allow an attacker to read or modify sensitive database information within the affected application context. This may compromise the confidentiality and integrity of the resort management system's data. However, no known exploits have been observed, and the extent of impact depends on the deployment environment and database privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to apply input validation and sanitization controls on the affected parameter in /orms/admin/rooms/view_room.php. Monitoring for unusual database activity may also help detect exploitation attempts. Avoid exposing the vulnerable endpoint to untrusted users if possible.