CVE-2026-3806
published 2026-03-09CVE-2026-3806: A weakness has been identified in SourceCodester/janobe Resort Reservation System 1.0. This issue affects some unknown processing of the file /room_rates.php…
PriorityP357high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
0.29%
21.4th percentile
A weakness has been identified in SourceCodester/janobe Resort Reservation System 1.0. This issue affects some unknown processing of the file /room_rates.php. This manipulation of the argument q causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| janobe | resort_reservation_system | — | — |
| oretnom23 | resort_reservation_system | — | — |
| sourcecodester | resort_reservation_system | — | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv4.02.1LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
pypdf: Inefficient decoding of FlateDecode PNG predictor streams
ghsa·2026-06-16
CVE-2026-49460 [MEDIUM] CWE-407 pypdf: Inefficient decoding of FlateDecode PNG predictor streams
pypdf: Inefficient decoding of FlateDecode PNG predictor streams
### Impact
An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the `/FlateDecode` filter with a PNG predictor.
### Patches
This has been fixed in [pypdf==6.12.2](https://github.com/py-pdf/pypdf/releases/tag/6.12.2).
### Workarounds
If you cannot upgrade yet, consider applying the changes from PR [#3806](https://github.com/py-pdf/pypdf/pull/3806).
GHSA
GHSA-3w3m-7xpm-xrwg: A weakness has been identified in SourceCodester/janobe Resort Reservation System 1
ghsa_unreviewed·2026-03-09
CVE-2026-3806 [MEDIUM] CWE-74 GHSA-3w3m-7xpm-xrwg: A weakness has been identified in SourceCodester/janobe Resort Reservation System 1
A weakness has been identified in SourceCodester/janobe Resort Reservation System 1.0. This issue affects some unknown processing of the file /room_rates.php. This manipulation of the argument q causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-03-09
Published