---
id: CVE-2026-86284
title: >-
  A security vulnerability has been detected in jaychouchannel
  Tourism-Management-System up to 8122bf020d91199eddfff3ee02d1632a70a9a132
summary: >-
  A security vulnerability has been detected in jaychouchannel
  Tourism-Management-System up to 8122bf020d91199eddfff3ee02d1632a70a9a132.
  Affected by this vulnerability is the function getOption of the file
  travel/src/main/java/com/controll…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-200
  - CWE-284
vendor: jaychouchannel
product: Tourism-Management-System
affected:
  - Tourism-Management-System 8122bf020d91199eddfff3ee02d1632a70a9a132
published: '2026-09-07'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T15:18:53.623'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-86284'
references:
  - url: 'https://github.com/jaychouchannel/Tourism-Management-System/'
    label: cna@vuldb.com
  - url: >-
      https://github.com/jaychouchannel/Tourism-Management-System/commit/d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86
    label: cna@vuldb.com
  - url: 'https://github.com/jaychouchannel/Tourism-Management-System/pull/14'
    label: cna@vuldb.com
  - url: 'https://github.com/jaychouchannel/Tourism_Management_System/issues/8'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/cve/CVE-2026-86284'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/submit/905644'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/399444'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/399444/cti'
    label: cna@vuldb.com
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-08T14:15:51.145547Z'
epss: 0.0055
epssPercentile: 0.43545
ingestedAt: '2026-09-08T15:33:26.975Z'
---

## Overview

A security vulnerability has been detected in jaychouchannel Tourism-Management-System up to 8122bf020d91199eddfff3ee02d1632a70a9a132. Affected by this vulnerability is the function getOption of the file travel/src/main/java/com/controller/CommonController.java. The manipulation of the argument tableName/columnName leads to information disclosure. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The identifier of the patch is d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86. To fix this issue, it is recommended to deploy a patch.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.