Is there a public PoC exploit available for CVE-2025-8380?

Yes, a public proof-of-concept exploit is available for CVE-2025-8380. Prioritise patching immediately. EPSS: 0.1%.

Campcodes Online Hotel Reservation System CVE-2025-8380

Q: What is the CVSS score of CVE-2025-8380?

CVE-2025-8380 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

LOW

Cross-site Scripting (XSS) (CWE-79)

2025-07-31 cna@vuldb.com

PHP XSS Online Hotel Reservation System Campcodes

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 01:19 vuln.today

DescriptionCVE.org

A vulnerability classified as problematic was found in Campcodes Online Hotel Reservation System 1.0. This vulnerability affects unknown code of the file /admin/add_query_account.php. The manipulation of the argument Name leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Cross-site scripting (XSS) in Campcodes Online Hotel Reservation System 1.0 allows authenticated users to inject malicious scripts via the Name parameter in /admin/add_query_account.php, affecting the integrity of admin-level functionality. The vulnerability requires user interaction (UI:P) and authenticated access (PR:L), limiting direct remote exploitation to attackers with valid credentials; however, publicly available exploit code exists, and the CVSS 2.0 score with VI:L (integrity impact) reflects limited but confirmed damage potential in a stored XSS context.

Technical ContextAI

The vulnerability is a Stored Cross-Site Scripting (CWE-79) flaw in a PHP-based hotel reservation management interface. The /admin/add_query_account.php file fails to sanitize or validate the 'Name' input parameter before processing or storing it, allowing attackers to embed arbitrary JavaScript code that executes in the context of administrative sessions. This is a common weakness in legacy PHP applications that do not implement proper input validation, output encoding, or Content Security Policy headers. The affected system is a web-based reservation platform written in PHP, as indicated by the file path and the direct manipulation of admin interface parameters.

RemediationAI

No vendor-released patch identified at time of analysis. Immediate mitigation requires: (1) Update to a patched version if available by contacting Campcodes support via https://www.campcodes.com/ or checking for security updates; (2) As an interim compensating control, restrict access to /admin/add_query_account.php using network-level access controls (firewall rules, IP whitelisting) to limit exposure to trusted administrators only; (3) Implement input validation and output encoding in the Name parameter handler - sanitize all user input using PHP htmlspecialchars() or equivalent HTML entity encoding before storage and retrieval; (4) Deploy a Web Application Firewall (WAF) with XSS detection rules to block script payloads in the Name parameter; (5) Disable admin functionality if the feature is not actively used. Each control has trade-offs: network restriction may hamper legitimate admin access from remote locations; WAF may generate false positives; sanitization requires code changes. Until a vendor patch is released, a combination of access restriction and output encoding is the most practical short-term defense.