Description
A vulnerability was identified in code-projects Online Hotel Booking 1.0. Affected by this vulnerability is an unknown functionality of the file /booknow.php of the component Booking Endpoint. Such manipulation of the argument roomname leads to cross site scripting. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
Published: 2026-04-06
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Cross‑Site Scripting
Action: Apply Patch
AI Analysis

Impact

The vulnerability resides in the booknow.php endpoint of the Online Hotel Booking application, where the roomname parameter is reflected in the page output without proper sanitization. This flaw enables an attacker to inject arbitrary HTML and JavaScript that is executed in the browsers of users who view the affected page. The impact is typical of a reflected XSS: attackers could hijack user sessions, steal cookies, deface content, or exfiltrate data. The weakness corresponds to the CWE identifiers for unsanitized input (CWE‑79) and potential code injection (CWE‑94).

Affected Systems

This issue affects the Code Projects Online Hotel Booking product, specifically version 1.0 of the booking endpoint. No other versions are listed as impacted in the available vendor data.

Risk and Exploitability

The CVSS score is 5.3, indicating a moderate severity level. While the EPSS score is unavailable, the vulnerability is publicly exploitable via a straightforward HTTP request to the booknow.php page with a crafted roomname value. It is not currently listed in the CISA KEV catalog, but because the exploit is available and can be launched remotely, the practical risk remains significant. Attackers do not need special privileges; simply visiting a malicious URL suffices to trigger the XSS execution. The risk is therefore tangible for any site running the vulnerable version.

Generated by OpenCVE AI on April 7, 2026 at 01:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest security update or patch released by Code Projects for the Online Hotel Booking application.
  • Sanitize and encode the roomname parameter on the server side before echoing it in any HTML output, following OWASP best practices for escaping user input.
  • Deploy a content‑security‑policy header that restricts script sources, limiting the damage potential of any remaining XSS vectors.
  • Conduct a focused penetration test or security audit to verify that the input handling is now safe and that no other pages reflect unsanitized data.

Generated by OpenCVE AI on April 7, 2026 at 01:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 08 Apr 2026 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 07 Apr 2026 09:45:00 +0000

Type Values Removed Values Added
First Time appeared Code-projects
Code-projects online Hotel Booking
Vendors & Products Code-projects
Code-projects online Hotel Booking

Tue, 07 Apr 2026 00:00:00 +0000

Type Values Removed Values Added
Description A vulnerability was identified in code-projects Online Hotel Booking 1.0. Affected by this vulnerability is an unknown functionality of the file /booknow.php of the component Booking Endpoint. Such manipulation of the argument roomname leads to cross site scripting. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
Title code-projects Online Hotel Booking Booking Endpoint booknow.php cross site scripting
Weaknesses CWE-79
CWE-94
References
Metrics cvssV2_0

{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Code-projects Online Hotel Booking
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-04-08T14:10:54.835Z

Reserved: 2026-04-06T14:17:03.519Z

Link: CVE-2026-5705

cve-icon Vulnrichment

Updated: 2026-04-08T14:10:49.869Z

cve-icon NVD

Status : Deferred

Published: 2026-04-07T00:16:21.440

Modified: 2026-04-29T01:00:01.613

Link: CVE-2026-5705

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-07T09:36:27Z

Weaknesses