CVE-2026-2848 is a SQL injection in SourceCodester Simple Responsive Tourism Website 1.0, scored 7.3 (high). The Username argument of the registration handler is the problem, and a public exploit is noted. The record lists no fixed version, so take the app offline or put it behind strict controls.
What's affected
The record names one product and version: Simple Responsive Tourism Website 1.0 from SourceCodester. The affected code is the registration function in /classes/Master.php (the register action), through the Username parameter.
The record does not list a patched release. Treat every copy of this version as affected.
How to check if you're exposed
Look for the project on your servers. Search web roots for the file name from the advisory:
find /var/www -path '*classes/Master.php' 2>/dev/null
If the file exists and the project is the tourism website, you are running the affected code. Check the vendor site and the VulDB entry for any later guidance.
What to do now
- Inventory every deployment of this application, including test and demo copies.
- Remove it from the public internet or restrict access at the network layer until a fix exists.
- If it must stay up, rewrite the registration query to use parameterized statements, and review the database account so it has only the rights the app needs.
- Watch the VulDB entry and the vendor site for a fixed release, and re-check this CVE when one appears.
Why it matters
This is classic SQL injection, CWE-89, filed under the broader injection class CWE-74. User input reaches a database query without being kept separate from the query text, so the database may treat input as part of the command.
Small template projects like this one are often installed by non-specialists and never updated. The record states the exploit has been published. It is not in CISA's Known Exploited Vulnerabilities catalog according to the record.
Quick check
Is there a patch?
The record does not list one, and nothing I could confirm names a fixed version. Check the vendor page and VulDB, and assume the code stays vulnerable until you see a release.
Sources
Last reviewed: 19 October 2026.
