A stored cross‑site scripting flaw exists in the Hotel and Tourism Reservation System’s /ht/tour.php file. By manipulating the query string parameters, such as "/email", "/people", or "/number", an attacker can inject arbitrary JavaScript code. When a user visits the affected page, the injected script runs in the user’s browser, enabling the attacker to steal session cookies, deface content, or redirect the user to malicious sites. This vulnerability is categorized as CWE‑79 (Improper Neutralization of Input During Web Page Generation). The vulnerability also intersects with CWE‑94 (Improper Control of Code Generation) because the injected code can control script execution flow.

The affected product is the code‑projects Hotel and Tourism Reservation System, version 1.0. The bug is located in the tour.php component, which accepts user supplied parameters via the URL and reflects them without proper validation or encoding. No other products or versions are listed as affected in the CVE data.

The CVSS base score is 5.3, indicating a moderate impact. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack can be initiated remotely by sending a specially crafted URL to a victim. A public exploit has already been released, meaning an attacker only needs to send a malicious link to a target user. Given the moderate severity and public availability of the exploit, organizations using this system should treat the vulnerability with urgency but can prioritize remediation after assessing exposure risk.