CVE-2026-10288: code-projects Hotel and Tourism Reservation System Admin Login login.php password_verify improper authentication
A vulnerability was identified in code-projects Hotel and Tourism Reservation System 1.0. This issue affects the function passwordverify of the file /admin/login.php of the component Admin Login. Such manipulation of the argument Password leads to improper authentication. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
code-projects Hotel and Tourism Reservation System - Admin Loginfrom your environment.If the admin interface is not required, disable or remove the Admin Login component (the /admin/ area) to eliminate remote exposure until the vulnerability is remediated.
- Configuration
Audit and correct the authentication code in /admin/login.php so that password verification cannot be manipulated. Validate and sanitize all inputs to the login routine, ensure the password verification function is called with the correct arguments and logic, handle failure cases explicitly, and add server-side checks to prevent bypassing authentication.
Hotel and Tourism Reservation System - Admin Login (/admin/login.php) password verification = ensure password verification cannot be bypassed or manipulated - Compensating control
Restrict remote access to the admin interface (/admin/) — implement an IP allowlist, place the admin area behind a VPN, require access via an internal network only, or protect it with a Web Application Firewall until a code fix is deployed.
- Operational
Reset/rotate all administrator and other sensitive credentials that could have been exposed or abused due to the improper authentication vulnerability; force password changes for affected accounts.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10288?
CVE-2026-10288 has a high severity rating of 7.3.
How do I fix CVE-2026-10288?
To fix CVE-2026-10288, ensure that the password verification process in the /admin/login.php file is implemented correctly following security best practices.
What systems are affected by CVE-2026-10288?
CVE-2026-10288 affects the Code-projects Hotel and Tourism Reservation System version 1.0.
What type of exploit is associated with CVE-2026-10288?
CVE-2026-10288 is associated with improper authentication due to manipulation of the password verification argument.
Can CVE-2026-10288 be exploited remotely?
Yes, CVE-2026-10288 can be exploited remotely, as indicated by the attack vector AV:N.