A critical SQL injection flaw (CVSS 9.8) in Win Men Intermational's Travel Agency Management System lets unauthenticated remote attackers read, modify, and delete database contents.
What Is It
CVE-2026-19425 is a SQL injection vulnerability (CWE-89) in the Travel Agency Management System developed by Win Men Intermational, disclosed by TWCERT/CC on August 11, 2026. Unauthenticated remote attackers can inject arbitrary SQL commands into the application, gaining the ability to read, modify, and delete database contents.
The vendor name is reproduced here exactly as it appears in the CVE record. "Intermational" is most likely a rendering of "International," but the spelling has not been corrected in the published advisory data, so defenders searching vendor inventories or asset databases should try both forms.
The primary base score is 9.8 (Critical), derived from the metrics AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, network-reachable, low attack complexity, no privileges, and no user interaction required, with high impact to confidentiality, integrity, and availability. Note that the vector string in the supplied record is internally inconsistent: it carries a CVSS:4.0/ version prefix but uses CVSS v3.1 metrics, including Scope (S:U), which does not exist in v4.0. The 9.8 figure is consistent with a v3.1 scoring of those metrics, and should be read as a v3.1 base score pending NVD analysis. A separate CVSS v4.0 assessment from the same source scores the issue 9.3 (Critical).
Why It Matters
The flaw combines the properties that make a web application vulnerability straightforward to exploit at scale: no authentication, no user interaction, low attack complexity, and full read/write/delete access to backend data. A travel agency management platform is a natural repository for customer identity records, itineraries, and booking data, and this vulnerability places all of it, along with the integrity of the records themselves, within reach of any attacker who can reach the application over the network.
CISA has not added CVE-2026-19425 to the Known Exploited Vulnerabilities catalog; no KEV entry was supplied, and no evidence of active exploitation is present in the source data. Exploit maturity in the CVSS v4.0 metrics is listed as Not Defined.
What's Vulnerable
- Vendor: Win Men Intermational (spelling as published; likely "International")
- Product: Travel Agency Management System
- Affected versions: all versions
No affected CPE identifiers have been published for this CVE.
Patch Status
The supplied NVD record does not specify a patch, fixed version, or vendor remediation guidance. The CVE was published August 11, 2026 and remains in "Received" status, meaning NVD analysis is not yet complete. Operators should consult the TWCERT/CC advisories below for vendor-supplied remediation instructions.
Sources
- NVD, CVE-2026-19425: https://nvd.nist.gov/vuln/detail/CVE-2026-19425
- TWCERT/CC Advisory (English): https://www.twcert.org.tw/en/cp-139-11099-56aa8-2.html
- TWCERT/CC Advisory (Chinese): https://www.twcert.org.tw/tw/cp-132-11098-0fb4a-1.html