Critical SQL Injection Vulnerability (CVE-2026-19425) Discovered in Travel Agency Management System

A critical SQL Injection vulnerability, tracked as CVE-2026-19425, has been identified in the Travel Agency Management System developed by Win Men International. This flaw allows unauthenticated remote attackers to inject arbitrary SQL commands, potentially leading to unauthorized modification or deletion of database contents, data corruption, and system integrity compromise. The vulnerability stems from improper handling of user input parameters in SQL queries without proper sanitization.