The vulnerability arises from the handling of the "room" argument in //details.php. By supplying a crafted value, an attacker can inject JavaScript that will execute in the victim’s browser. This allows the attacker to steal session cookies, deface the page, or perform other client‑side attacks. The weakness is classified as a reflected cross‑site scripting vulnerability (CWE‑79). Although the description also references CWE‑94, no specific server‑side code injection has been demonstrated; the current impact remains client‑side execution.

The affected product is code‑projects Hotel and Tourism Reservation in PHP, version 1.0, as identified by the CNA. The vulnerable functionality resides in an unknown function within details.php and involves the "room" parameter.

The CVSS score of 5.3 denotes a moderate impact. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog, indicating that widespread exploitation has not been reported. Exploitation can be triggered remotely by including crafted content in the "room" parameter of a URL. Because the vulnerability is client‑side, an attacker can maximize damage by targeting users who visit the affected page.