The vulnerability is a stored cross‑site scripting flaw triggered by manipulating the ID parameter in the reservation management module of the web application. Attackers can inject arbitrary JavaScript that will execute in the browsers of users who view the affected page, potentially compromising session cookies, defacing content, or delivering further malware. The weakness maps to CWE‑79 for cross‑site scripting and CWE‑94 for insecure code execution. The flaw is exposed through a malformed request to the /?page=manage_reservation endpoint and can be triggered remotely without any authentication.

This weakness affects the SourceCodester Resort Reservation System 1.0, version 1.0, released by SourceCodester. No other versions or components are listed as affected in the CNA data.

The CVSS score of 5.1 indicates moderate severity, and the EPSS score of less than 1% signals a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The attack vector is remote, relying on a crafted ID value in a public HTTP request, and the exploit is publicly disclosed, making it feasible for an adversary. While the risk is moderate, the possibility of widespread use by automated scanners or social engineers warrants timely remediation.