{"id":"CVE-2026-86284","title":"A security vulnerability has been detected in jaychouchannel Tourism-Management-System up to 8122bf020d91199eddfff3ee02d1632a70a9a132","summary":"A security vulnerability has been detected in jaychouchannel Tourism-Management-System up to 8122bf020d91199eddfff3ee02d1632a70a9a132. Affected by this vulnerability is the function getOption of the file travel/src/main/java/com/controll…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cwe":["CWE-200","CWE-284"],"vendor":"jaychouchannel","product":"Tourism-Management-System","affected":["Tourism-Management-System 8122bf020d91199eddfff3ee02d1632a70a9a132"],"published":"2026-09-07","updated":"2026-09-08","sourceUpdated":"2026-09-08T15:18:53.623","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-86284","references":[{"url":"https://github.com/jaychouchannel/Tourism-Management-System/","label":"cna@vuldb.com"},{"url":"https://github.com/jaychouchannel/Tourism-Management-System/commit/d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86","label":"cna@vuldb.com"},{"url":"https://github.com/jaychouchannel/Tourism-Management-System/pull/14","label":"cna@vuldb.com"},{"url":"https://github.com/jaychouchannel/Tourism_Management_System/issues/8","label":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-86284","label":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/905644","label":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/399444","label":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/399444/cti","label":"cna@vuldb.com"}],"tags":["nvd","cve.org","exploit-available"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"partial","timestamp":"2026-09-08T14:15:51.145547Z"},"epss":0.00322,"epssPercentile":0.25348,"ingestedAt":"2026-09-08T15:33:26.975Z","slug":"CVE-2026-86284","body":"## Overview\n\nA security vulnerability has been detected in jaychouchannel Tourism-Management-System up to 8122bf020d91199eddfff3ee02d1632a70a9a132. Affected by this vulnerability is the function getOption of the file travel/src/main/java/com/controller/CommonController.java. The manipulation of the argument tableName/columnName leads to information disclosure. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The identifier of the patch is d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86. To fix this issue, it is recommended to deploy a patch.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[]}