EUVD-2026-40061
GHSA-pjp7-3c49-rg8c
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Admin-panel endpoint strongly implies PR:H; user interaction required for XSS trigger; scope changes as script executes in victim browser with low C and I impact.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was identified in itsourcecode Online Hotel Management System 1.0. This vulnerability affects unknown code of the file /admin/mod_room/controller.php?action=add of the component POST Request Handler. Such manipulation of the argument Name leads to cross site scripting. The attack may be launched remotely. The exploit is publicly available and might be used.
AnalysisAI
Cross-site scripting in itsourcecode Online Hotel Management System 1.0 allows remote attackers to inject arbitrary JavaScript via the unsanitized Name parameter in POST requests to /admin/mod_room/controller.php?action=add. The CVSS 4.0 base score of 2.1 reflects constrained real-world impact: only vulnerable-system integrity is affected (VI:L), user interaction is required (UI:P), and no confidentiality or availability impact is assessed. A publicly available exploit exists (E:P per CVSS 4.0 supplemental vector), but no active exploitation has been confirmed via CISA KEV, consistent with the niche deployment footprint of this free PHP educational project.
Technical ContextAI
The affected application is a PHP-based hotel management system distributed by itsourcecode.com, a source-code sharing platform targeting students and hobbyists. The vulnerability resides in the room-management controller at /admin/mod_room/controller.php?action=add, which handles POST form submissions without applying output encoding to the Name argument before rendering it back to the browser. CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting) is the root cause class: user-supplied input flows directly into HTML output without sanitization via htmlspecialchars() or equivalent PHP escaping functions. The admin path context (/admin/) implies this endpoint is part of the backend management interface. No CPE string was provided in the intelligence data, so affected version scope is limited to what the description specifies: version 1.0.
RemediationAI
No vendor-released patch has been identified at the time of analysis; the fix version is not confirmed in any referenced advisory. The primary remediation is to apply output encoding to the Name parameter before rendering it in HTML context - specifically, wrapping the value with PHP's htmlspecialchars($name, ENT_QUOTES, 'UTF-8') before echo or print statements in the controller. As a compensating control, restrict access to the /admin/ directory via web server configuration (e.g., IP allowlisting in Apache .htaccess or nginx allow/deny directives) to trusted management networks only - this directly limits the attack surface given the admin-panel location of the vulnerable endpoint. Additionally, implementing a Content Security Policy (CSP) header with script-src 'self' would mitigate XSS payload execution even if injection succeeds. The POC is publicly documented at https://github.com/Hh-176/CVE/issues/8 and the VulDB entry is at https://vuldb.com/vuln/374565.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today