THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-54419 (CRITICAL 9.8) — claudiopizzillo PIAF-HMS (PBX-In-A-Flash Hotel Management System; no released versions, latest commit 389d2633441b65ced1c104212cd62be2bfca21e5) contains multiple unauthenticated SQL injection vulnerabilities. The application has no authentication mechanism and passes user-supplie

[NVD] CVE-2026-54419 (CRITICAL 9.8) — claudiopizzillo PIAF-HMS (PBX-In-A-Flash Hotel Management System; no released versions, latest commit 389d2633441b65ced1c104212cd62be2bfca21e5) contains multiple unauthenticated SQL injection vulnerabilities. The application has no authentication mechanism and passes user-supplie

lownvdPublished 2026-06-18

CVE-2026-54419 CVSS: 9.8 CRITICAL Published: 2026-06-18T14:17:31.887

claudiopizzillo PIAF-HMS (PBX-In-A-Flash Hotel Management System; no released versions, latest commit 389d2633441b65ced1c104212cd62be2bfca21e5) contains multiple unauthenticated SQL injection vulnerabilities. The application has no authentication mechanism and passes user-supplied HTTP parameters directly into deprecated mysql_q

MITRE ATT&CK techniques

VulnerabilitiesT1588.006

Indicators of compromise

389d2633441b65ced1c104212cd62be2bfca21e5sha1
CVE-2026-54419cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-54419