PHP CVE-2026-5705

Q: What is the CVSS score of CVE-2026-5705?

CVE-2026-5705 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-19559 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-04-07 cna@vuldb.com

PHP XSS

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

EUVD ID Assigned

Apr 07, 2026 - 00:22 euvd

EUVD-2026-19559

Analysis Generated

Apr 07, 2026 - 00:22 vuln.today

CVE Published

Apr 07, 2026 - 00:16 nvd

MEDIUM 5.3

DescriptionCVE.org

A vulnerability was identified in code-projects Online Hotel Booking 1.0. Affected by this vulnerability is an unknown functionality of the file /booknow.php of the component Booking Endpoint. Such manipulation of the argument roomname leads to cross site scripting. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

AnalysisAI

Reflected cross-site scripting (XSS) in code-projects Online Hotel Booking 1.0 allows unauthenticated remote attackers to inject malicious scripts via the roomname parameter in the /booknow.php endpoint, exploitable through user interaction (UI:P). Publicly available exploit code exists for this vulnerability, which carries a moderate CVSS score of 5.3 but limited impact scope (information disclosure only, no integrity or availability impact).

Technical ContextAI

This is a classic reflected XSS vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation) in a PHP-based hotel booking application. The /booknow.php endpoint fails to sanitize or encode user-supplied input from the roomname parameter before reflecting it in HTTP responses. An attacker crafts a malicious URL containing JavaScript code in the roomname parameter; when a victim visits this URL, the unvalidated input is rendered as executable script in their browser context. This affects the code-projects Online Hotel Booking system version 1.0, a PHP application available at code-projects.org.

RemediationAI

The primary remediation is to upgrade to a patched version if the vendor has released one; however, no vendor-released patch version has been identified in available data. Immediate mitigation measures include: (1) Apply output encoding to the roomname parameter and all user-supplied input before rendering in HTML responses (use context-appropriate encoding such as HTML entity encoding for URL parameters); (2) Implement Content Security Policy (CSP) headers to prevent inline script execution; (3) Perform input validation to reject or sanitize special characters; (4) Update to the latest version of code-projects Online Hotel Booking if available. Organizations using this software should contact code-projects.org directly for patch availability. In the interim, restrict access to the /booknow.php endpoint or disable the affected functionality if feasible.