TI-2026-59067 Aliases CVE-2026-86282 GHSA-3qqv-rr3f-4v86

jaychouchannel Tourism-Management-System CommonDao CommonController.java sql injection

HIGH 70CWE-74Published 2026-09-07 · Updated 2026-09-08

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: SQL injection
Confidentiality · integrity · availability: Low · Low · Low
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

A weakness has been identified in jaychouchannel Tourism-Management-System up to 8122bf020d91199eddfff3ee02d1632a70a9a132. Affected is an unknown function of the file travel/src/main/java/com/controller/CommonController.java of the component CommonDao. Executing a manipulation of the argument table/column/xColumn/yColumn can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. This patch is called d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86. A patch should be applied to remediate this issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00445 38th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
jaychouchannel	Tourism-Management-System	8122bf0	—	No fix listed	CNA

Tourism-Management-System Vendorjaychouchannel Affected 8122bf0 Fixed in — No fix listed CNA

CPE names CNA · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:jaychouchannel:tourism-management-system::::::::	—	—	jaychouchannel

cpe:2.3:a:jaychouchannel:tourism-management-system:*:*:*:*:*:*:*:* Versions — — ·jaychouchannel

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2026-86282
2026-10-03 Alias added: GHSA-3qqv-rr3f-4v86

References

Exploit 1

https://github.com/jaychouchannel/Tourism_Management_System/issues/7

Patch 2

Other 1

https://github.com/jaychouchannel/Tourism-Management-System/

TI-2026-61541 jaychouchannel Tourism-Management-System Update Endpoint missing authentication CVSS 4.0MEDIUM 6.9
TI-2026-61540 jaychouchannel Tourism-Management-System User Register Endpoint UsersController.java privileges management CVSS 4.0MEDIUM 6.9
TI-2026-61539 jaychouchannel Tourism-Management-System Password Recovery UsersController.java resetPass password recovery CVSS 4.0MEDIUM 6.9
TI-2026-59069 jaychouchannel Tourism-Management-System CommonController.java getOption information disclosure CVSS 4.0MEDIUM 6.9
TI-2026-61538 jaychouchannel Tourism-Management-System CRUD MenpiaodingdanController.java authorization CVSS 4.0MEDIUM 5.3
TI-2026-61537 jaychouchannel Tourism-Management-System Authorization Interceptor AuthorizationInterceptor.java improper authorization CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences