CVE-2026-86284: Information Disclosure in jaychouchannel Tourism-Management-System
Description
CVE-2026-86284 is an information disclosure vulnerability in the jaychouchannel Tourism-Management-System affecting the getOption function in CommonController.java. The vulnerability arises from manipulation of the tableName or columnName arguments, allowing remote attackers to disclose information. The product uses a rolling release model, so specific affected versions are not available. A patch identified by commit d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86 is recommended to fix the issue. The CVSS 4.0 base score is 6.9, indicating medium severity.
CVSS v4.0
Score 6.9medium
Affected software
jaychouchannel
Tourism-Management-System
cpe:2.3:a:jaychouchannel:tourism-management-system:*:*:*:*:*:*:*:*AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in jaychouchannel Tourism-Management-System up to commit 8122bf020d91199eddfff3ee02d1632a70a9a132 affects the getOption function in travel/src/main/java/com/controller/CommonController.java. By manipulating the tableName or columnName arguments, an attacker can cause information disclosure remotely without privileges or user interaction. The product's rolling release model means no fixed version numbers are provided. A patch exists identified by commit d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86 and should be deployed to remediate the vulnerability.
Potential Impact
An unauthenticated remote attacker can exploit this vulnerability to disclose sensitive information by manipulating input parameters in the getOption function. This could lead to exposure of internal data, potentially aiding further attacks or data leakage. The CVSS 4.0 score of 6.9 reflects a medium impact with low attack complexity and no required privileges or user interaction.
Mitigation Recommendations
A patch identified by commit d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86 is available and should be deployed to remediate this vulnerability. Since the product uses a rolling release model, users should update to the latest version containing this patch. No vendor advisory content contradicts this recommendation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-09-06T14:20:25.628Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a9e70cfacd9273b49345c7c
Added to database: 09/07/2026, 08:07:43 UTC
Last enriched: 09/15/2026, 01:08:03 UTC
Last updated: 10/22/2026, 01:15:26 UTC
Views: 77
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.