CVE-2026-2848: Oretnom23 Simple Responsive Tourism Website

What is CVE-2026-2848?

A flaw has been found in SourceCodester Simple Responsive Tourism Website 1.0. Affected by this vulnerability is an unknown functionality of the file /classes/Master.php?f=register of the component Registration. This manipulation of the argument Username causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used.

CVSS9.8 NVD 3.1

SeverityCRITICAL

ExploitationNo exploitation reported

EPSS<1% · P25

Triage statusNo Known Exploit

ActionPatch within 48 hours

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD published2026-02-20

NVD last modified2026-06-17

Timeline

2026-02-20Published to the U.S. National Vulnerability Database (NVD)
2026-06-17NVD record last updated

Affected product

Oretnom23 Simple Responsive Tourism Website

Remediation Steps

Apply security patches to Cscape and PLC firmware versions immediately
Reset all system credentials and force re-authentication across PLC interfaces
Implement firewall rules restricting PLC access to authorized engineering workstations only
Conduct forensic analysis of PLC logs to identify unauthorized access attempts
Enable detailed logging on all PLC authentication and configuration change events

References

Referenced in our briefings & reports

Vulnerability Priority Report – Week 3 of April 2026 (April 20 – 26)
Vulnerability Priority Report – Week 5 of March 2026 (March 30 – April 5)

Browse all tracked CVEs in the defend.network CVE database →

🤖 This CVE page is generated by defend.network from NVD, CISA KEV, EPSS, and our verified daily briefings. Severity and exploitation data come from official sources; always verify remediation steps against the official vendor advisory before acting in production.