Airline Reservation System CVE-2026-116514

Exploitation requires an attacker to supply a crafted value in the 'max' GET/POST argument of /book_flight.php in itsourcecode Airline Reservation System 1.0, and - per UI:P in the CVSS 4.0 vector - requires a victim to interact by opening the attacker-supplied link, which limits this to a targeted, social-engineering-dependent reflected XSS rather than a self-propagating or server-side compromise. No authentication is required (PR:N). Impact is bounded to the victim's browser session with only low integrity impact and no confidentiality or availability impact (VC:N/VI:L/VA:N), so the realistic effect is client-side script execution in the victim's context, not server takeover. The exact server-side trigger beyond the named file and parameter is not detailed in the available sources.

This is a low-severity reflected cross-site scripting flaw (CWE-79) in the 'max' argument of /book_flight.php in itsourcecode Airline Reservation System 1.0, and the signals are consistent in pointing to low real-world priority rather than a genuine emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N) yields only 2.1: network-reachable and unauthenticated, but requiring victim user interaction and producing only low integrity impact with no confidentiality or availability impact. EPSS is low at 0.35% (28th percentile), the vulnerability is NOT on the CISA KEV list, and the vuln.today decision label is 'monitor' - all three agree this is not actively exploited at scale. The only exploit signal is a public PoC reference (a GitHub issue), which is not verified as working exploit code, so it should not be treated as confirmed weaponization. The main caveat is attribution and depth: the record originates solely from VulDB with NVD/EUVD mirroring, and there is no independent vendor advisory confirming the exact vulnerable code path, so the mechanism rests on the reporter's description alone.

An attacker crafts a URL to /book_flight.php with a malicious payload in the 'max' parameter and lures a victim into clicking it (reflected XSS requiring user interaction per UI:P). When the victim's browser renders the unsanitized response, the injected script executes in the victim's session context, potentially performing actions or reading data as that user. A public PoC reference exists but is not verified as working exploit code.