EUVD-2026-40065
GHSA-832j-jrcx-835j
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible, no privileges to submit payload, but UI:R as admin must view injected content; S:C and C:L because XSS executes in victim browser and can exfiltrate session data.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability has been found in itsourcecode Online Hotel Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/mod_amenities/controller.php?action=add of the component POST Request Handler. The manipulation of the argument Name leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
AnalysisAI
Cross-site scripting in itsourcecode Online Hotel Management System 1.0 enables remote attackers to inject arbitrary JavaScript via the Name parameter in the amenities management POST handler at /admin/mod_amenities/controller.php?action=add. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) confirms no authentication or special attack conditions are required to submit the payload, but passive user interaction - an admin browsing the amenities panel - is needed to trigger execution. A proof-of-concept exploit has been publicly disclosed via GitHub (VulDB submission 843584), though no active exploitation has been confirmed by CISA KEV.
Technical ContextAI
The affected component is a PHP POST request handler within the admin module of Online Hotel Management System 1.0, distributed by itsourcecode.com as a tutorial/demonstration PHP web application. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting): the Name argument submitted to the add action is rendered back into the page without sufficient output encoding or input sanitization. The CVSS 4.0 supplemental metric E:P confirms a public proof-of-concept exists. The PHP tag in the intelligence data corroborates the server-side language. No CPE strings were provided, but the product is identified as version 1.0 from the NVD description and itsourcecode.com reference. The XSS class (stored or reflected - not explicitly confirmed) allows injected scripts to execute in the browser context of any user who subsequently views the affected admin page.
RemediationAI
No vendor-released patch has been identified at time of analysis; the itsourcecode.com reference points to the product homepage rather than a dedicated security advisory. The primary remediation is to apply output encoding to the Name parameter before rendering it in any HTML context - specifically, PHP's htmlspecialchars() with ENT_QUOTES should be applied on output, and input validation should reject or sanitize HTML metacharacters on ingestion. As a compensating control, restrict access to /admin/mod_amenities/controller.php via web server authentication rules (e.g., HTTP Basic Auth or IP allowlist at the server/WAF layer) to prevent unauthenticated POST submissions; note this does not fix the underlying flaw but removes the PR:N condition. Deploying a Web Application Firewall rule blocking script tags and JavaScript event handlers in POST body parameters provides an additional layer of defense with low operational overhead. Given this is tutorial software, replacing it with a maintained alternative is the most durable remediation. Track updates via https://vuldb.com/vuln/374562.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today