Posting Date: 2026/08/13

【Vulnerability Alert】VMING｜Travel Agency Management System - SQL Injection

  • Subject: 【Vulnerability Alert】VMING｜Travel Agency Management System - SQL Injection


  • Description:
    • Forwarded Cybersecurity Alert from Taiwan Computer Emergency Response Team/Coordination Center TWCERTCC-200-202608-00000008
    • 【VMING｜Travel Agency Management System - SQL Injection】(CVE-2026-19425, CVSS: 9.8) A SQL Injection vulnerability exists in the Travel Agency Management System developed by VMING. An unauthenticated remote attacker can inject arbitrary SQL commands to read, modify, and delete database contents.
  • Affected Systems:
    • All versions of Travel Agency Management System prior to the August 2026 security update
  • Recommendations:
    • August 2026 security update
  • References:
    1. https://www.twcert.org.tw/tw/cp-132-11098-0fb4a-1.html

Computer and Communication Center
Network System Division