CVE-2026-108937
5.3MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-200, CWE-538
Impact
Remote, unauthenticated attackers can read sensitive database structure or data by directly requesting exposed database dump files. They only need network access to the web server.
Root cause
The database backup file /database/medallion.sql is stored inside the publicly accessible web root without access controls.
Affected systems
code-projects Online Ticket Reservation System 1.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Fix & remediation
No fixed release is documented. Block public HTTP access to the /database/ directory or remove the medallion.sql file from the web server.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A vulnerability was detected in code-projects Online Ticket Reservation System 1.0. This vulnerability affects unknown code of the file /database/medallion.sql. The manipulation results in file and directory information exposure. It is possible to launch the attack remotely. The exploit is now public and may be used.