Is there a public PoC exploit available for CVE-2026-10289?

Yes, a public proof-of-concept exploit is available for CVE-2026-10289. Prioritise patching immediately. EPSS: 0.0%.

Hotel and Tourism Reservation System CVE-2026-10289

Q: What is the CVSS score of CVE-2026-10289?

CVE-2026-10289 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33763 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-06-01 VulDB

GHSA-hf48-72gv-xr79

PHP XSS Hotel And Tourism Reservation System Code Projects

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Jun 01, 2026 - 21:22 NVD

MEDIUM LOW

CVSS changed

Jun 01, 2026 - 21:22 NVD

4.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jun 01, 2026 - 20:53 vuln.today

DescriptionCVE.org

A security flaw has been discovered in code-projects Hotel and Tourism Reservation System 1.0. Impacted is an unknown function of the file /ht/tour.php. Performing a manipulation of the argument name /email /people /number results in cross site scripting. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

Cross-site scripting in code-projects Hotel and Tourism Reservation System 1.0 allows remote unauthenticated attackers to inject and execute arbitrary JavaScript by manipulating the name, email, people, or number parameters submitted to /ht/tour.php. The POC repository title ('Stored-XSS') strongly suggests this is a persistent (stored) XSS variant, meaning injected payloads survive in the application and execute in the browsers of subsequent users who view the affected reservation data - not merely the attacker's own session. Publicly available exploit code exists; this CVE has not been added to the CISA KEV catalog at time of analysis.

Technical ContextAI

The affected application is a PHP-based web application (code-projects Hotel and Tourism Reservation System 1.0, CPE: cpe:2.3:a:code-projects:hotel_and_tourism_reservation_system:*:*:*:*:*:*:*:*) that processes tourism reservation form input at the endpoint /ht/tour.php. The root cause maps to CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-supplied data in at least four form fields - name, email, people, and number - is reflected or stored and subsequently rendered in HTML responses without adequate sanitization or output encoding. PHP applications with no input validation or Content-Security-Policy headers are particularly susceptible. The '*' version wildcard in the CPE string suggests NVD has not independently confirmed a specific patched version, implying the entire 1.0 release line is affected.

RemediationAI

No vendor-released patch has been identified at time of analysis - the CVSS temporal metric RL:X (remediation level not defined) and absence of any advisory from code-projects.org corroborate this. Organizations running this software should apply the following specific compensating controls: first, implement server-side input validation and output encoding on all user-supplied parameters (name, email, people, number) in tour.php, escaping HTML special characters before rendering - this directly addresses CWE-79 without requiring a vendor patch, though it requires code-level access. Second, deploy a Web Application Firewall (WAF) rule to detect and block XSS payloads in POST/GET parameters to /ht/tour.php; note this adds latency and may produce false positives on legitimate inputs containing special characters. Third, implement a Content-Security-Policy (CSP) HTTP response header restricting script execution to trusted origins, which degrades the impact of successful injection even if payload delivery occurs. Fourth, if the application is not required to be internet-facing, restrict access to trusted IP ranges at the network perimeter. Monitor the vendor site at https://code-projects.org/ and the VulDB entry at https://vuldb.com/cve/CVE-2026-10289 for patch availability.