CVE-2026-108937: code-projects online ticket reservation system
Vulnerability summary
CVE-2026-108937 is a medium (CVSS 6.9) vulnerability in code-projects online ticket reservation system. EPSS estimates a 0.33% chance of exploitation in the next 30 days, higher than 24.5% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 12-10-2026PublishedVulnerability first disclosed.
- 15-10-2026Last modifiedVulnerability information updated.
Description
A vulnerability was detected in code-projects Online Ticket Reservation System 1.0. This vulnerability affects unknown code of the file /database/medallion.sql. The manipulation results in file and directory information exposure. It is possible to launch the attack remotely. The exploit is now public and may be used.
CVSS metrics
7 scores · 2 sources · 4 versions- NVDNIST5.5MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XDiffers
- CVE.orgCNA5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
- CVE.orgCNA5.0MediumAV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR
EPSS trend
Probability
0.33%
Chance of exploitation in the next 30 days
Percentile
25%
Versus all other CVEs
30-day change
Change unavailable
Change unavailable
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundOnline Ticket Reservation System
Maturity: poc
Weaknesses
CWE · root cause- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
- CWE-538Insertion of Sensitive Information into Externally-Accessible File or DirectoryThe product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information.
Affected systems
Code-projects1 product
1 vendor · 1 product
References
6 links- code-projects.orgProduct
- github.com/KaranParelkar/…Exploit
- vuldb.com/cve/CVE-2026-108937Third Party Advisory
- vuldb.com/submit/997564Third Party Advisory
- vuldb.com/vuln/416761VDB Entry