Campcodes Online Hotel Reservation System CVE-2025-8380

No vendor-released patch identified at time of analysis. Immediate mitigation requires: (1) Update to a patched version if available by contacting Campcodes support via https://www.campcodes.com/ or checking for security updates; (2) As an interim compensating control, restrict access to /admin/add_query_account.php using network-level access controls (firewall rules, IP whitelisting) to limit exposure to trusted administrators only; (3) Implement input validation and output encoding in the Name parameter handler - sanitize all user input using PHP htmlspecialchars() or equivalent HTML entity encoding before storage and retrieval; (4) Deploy a Web Application Firewall (WAF) with XSS detection rules to block script payloads in the Name parameter; (5) Disable admin functionality if the feature is not actively used. Each control has trade-offs: network restriction may hamper legitimate admin access from remote locations; WAF may generate false positives; sanitization requires code changes. Until a vendor patch is released, a combination of access restriction and output encoding is the most practical short-term defense.