EUVD-2025-209443

| CVE-2025-65132 MEDIUM

2026-04-14 mitre

GHSA-h7gf-v98f-2qm9

PHP XSS

6.1

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 14, 2026 - 19:40 vuln.today

CVSS Changed

Apr 14, 2026 - 18:22 NVD

6.1 (MEDIUM)

DescriptionNVD

alandsilva26 hotel-management-php 1.0 is vulnerable to Cross Site Scripting (XSS) in /public/admin/edit_room.php which allows an attacker to inject and execute arbitrary JavaScript via the room_id GET parameter.

AnalysisAI

Stored or reflected cross-site scripting (XSS) in alandsilva26 hotel-management-php 1.0 allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in the context of authenticated administrators via a malicious room_id GET parameter in /public/admin/edit_room.php. Public exploit code exists (SSVC confirms poc status). The vulnerability requires user interaction (UI:R) to trigger, affecting confidentiality and integrity of admin sessions with partial technical impact.

Technical ContextAI

The vulnerability exploits insufficient input validation and output encoding in a PHP-based hotel management application. The room_id GET parameter is reflected in the admin edit room page without proper HTML entity encoding or sanitization, allowing injection of arbitrary JavaScript. This is a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) vulnerability. The attack surface is the HTTP request handler in /public/admin/edit_room.php, which processes user-supplied room_id values and renders them directly into the HTML response without encoding. The vulnerability affects the entire hotel-management-php 1.0 application, as indicated by the wildcard CPE notation and version specification.

RemediationAI

Immediate action: upgrade hotel-management-php to a patched version released after 1.0 if available from the vendor. If no patched release is available, apply input validation and output encoding fixes to /public/admin/edit_room.php by: (1) validating room_id as a numeric integer using PHP's intval() or preg_match() with strict patterns; (2) HTML-encoding all user input in the output using htmlspecialchars($room_id, ENT_QUOTES, 'UTF-8') before rendering into HTML attributes or content; (3) implementing Content Security Policy (CSP) headers to restrict script execution. As an interim workaround, restrict access to /public/admin/ via web application firewall rules or IP whitelisting until a patched version is deployed. Consult the GitHub security advisory and NVD detail page (https://nvd.nist.gov/vuln/detail/CVE-2025-65132) for vendor-specific guidance and timeline.

EUVD-2025-209443 vulnerability details – vuln.today

Back