A SQL injection vulnerability (CVE-2026-3736) was discovered in Simple Flight Ticket Booking System 1.0. The vulnerability affects the SearchResultRoundtrip.php file through manipulation of the 'from' argument parameter. The attack can be executed remotely and exploit code has been publicly released. This represents a high-severity security issue that could allow attackers to access or manipulate database information through malicious SQL queries.