The vulnerability is a classic Cross‑Site Scripting flaw located in the edit_room.php endpoint of the hotel‑management‑php application. The flaw is triggered when an attacker supplies a specially crafted value for the room_id GET parameter, resulting in arbitrary JavaScript code being injected and executed in the victim’s browser. This allows an attacker to perform session hijacking, steal credentials, deface the site, or carry out other malicious client‑side actions.

The only affected product listed is hotel‑management‑php version 1.0. No vendor or product name is supplied by the CNA, so the scope is limited to installations of that exact version of the application.

Because the flaw is triggered by a URL parameter, an attacker can exploit it from any location with network access to the application. No CVSS or EPSS score is provided, and the vulnerability is not present in the CISA KEV list. Nonetheless, XSS represents a high risk to confidentiality and integrity of user data, and remediation is strongly advised.