CVE-2026-54419 -- CVSS 9.8 Vulnerability Briefing
CVE-2026-54419 | CVSS 9.8 (Critical) | Exploit: No known exploit
What Is It
CVE-2026-54419 describes multiple unauthenticated SQL injection vulnerabilities in claudiopizzillo's PIAF-HMS (PBX-In-A-Flash Hotel Management System), an open-source hotel management application with no formal released versions, affecting the latest available commit (389d2633441b65ced1c104212cd62be2bfca21e5).
Technical Detail
The vulnerabilities are SQL injection flaws that can be triggered by unauthenticated remote attackers, meaning no valid credentials or session tokens are required to reach the affected code paths. An attacker can craft malicious SQL statements through vulnerable input parameters to manipulate backend database queries, potentially enabling unauthorized data extraction, modification, or deletion of the underlying database contents. Depending on database server configuration and permissions, exploitation could also facilitate further compromise of the host system through techniques such as file read/write operations or command execution via database-native functions.
Exploitation Status
No known exploit code has been publicly identified at this time, and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. The exploit maturity is currently assessed as none, meaning no public proof-of-concept or operational exploit has been confirmed. However, unauthenticated SQL injection vulnerabilities of this class are generally straightforward to exploit once the affected endpoints are identified, and the absence of known exploit code does not indicate low risk.
Who Is Targeting This
No confirmed threat actor attribution exists for this vulnerability at this time. Reported attribution carries no specific named actor; the data reflects no public attribution with medium confidence. No origin, motivation, or campaign activity has been associated with this CVE in available intelligence sources.
What To Do
Because PIAF-HMS has no formal release versioning, organizations running any instance of this software should treat the current codebase as unpatched and unverified. The immediate recommended action is to take any internet-exposed PIAF-HMS instances offline or place them behind strict network access controls, limiting exposure to trusted internal networks only. Operators should review the source code at the affected commit and apply input validation and parameterized query practices to all database-facing input handlers. Given the unauthenticated nature of the flaw, web application firewall rules blocking SQL metacharacter sequences in relevant request parameters can serve as a temporary compensating control. Monitor database logs for anomalous query patterns indicative of injection attempts. Organizations should evaluate whether continued use of this software is appropriate given its lack of formal versioning and maintenance status.