EUVD-2026-40059
GHSA-3qrp-f55m-c6cw
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered XSS requiring victim interaction; scope changes to browser context with low confidentiality and integrity impact consistent with session-based attacks.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was determined in itsourcecode Online Hotel Management System 1.0. This affects an unknown part of the file /admin/mod_users/controller.php?action=edit of the component POST Request Handler. This manipulation of the argument Name causes cross site scripting. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.
AnalysisAI
Cross-site scripting in itsourcecode Online Hotel Management System 1.0 allows remote attackers to inject malicious JavaScript via the Name argument in a POST request to /admin/mod_users/controller.php?action=edit. The vulnerability requires a victim to interact with the crafted content (CVSS 4.0 UI:P), limiting its reach but not eliminating risk against administrative users. A publicly disclosed proof-of-concept exploit exists per VulDB submission 843586, though no public exploit identified at time of analysis in CISA KEV.
Technical ContextAI
The affected application is a PHP-based hotel management system distributed by itsourcecode, a source code tutorial platform. The vulnerable endpoint is /admin/mod_users/controller.php?action=edit, which handles POST requests for user record modification within the admin module. CWE-79 (Improper Neutralization of Input During Web Page Generation) describes the root cause: the Name parameter received via POST is not properly sanitized or output-encoded before being rendered in the HTTP response. This permits injection of arbitrary HTML or JavaScript that executes in the context of a victim's browser session. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) indicates the attack is network-reachable, requires no special conditions, needs no prior authentication from the attacker's perspective, but does require a user to interact with the malicious content.
RemediationAI
No vendor-released patch has been identified at time of analysis; the fix version is not independently confirmed from the available references. The primary remediation is to apply proper output encoding to the Name parameter before rendering it in HTML context - specifically using htmlspecialchars() or equivalent PHP escaping functions on all user-supplied data rendered in the admin view. As a compensating control, restrict access to the /admin/ directory to trusted IP ranges via web server configuration (e.g., Apache .htaccess Allow/Deny directives or nginx allow/deny blocks), which limits the attacker's ability to submit or trigger payloads. Additionally, implementing a Content Security Policy (CSP) header that disallows inline scripts (script-src 'self') would significantly reduce the impact of any surviving XSS. Developers should review https://vuldb.com/vuln/374564 and the associated GitHub issue at https://github.com/Hh-176/CVE/issues/7 for technical detail. The trade-off of IP restriction is reduced accessibility for remote administrators.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today