CVE-2026-5705

MEDIUM

code-projects Online Hotel Booking Booking Endpoint booknow.php cross site scripting

Title source: cna

Description

A vulnerability was identified in code-projects Online Hotel Booking 1.0. Affected by this vulnerability is an unknown functionality of the file /booknow.php of the component Booking Endpoint. Such manipulation of the argument roomname leads to cross site scripting. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

References (5)

Core 5

Core References

Vdb Entry, Technical Description vdb-entry technical-description

VDB-355521 | code-projects Online Hotel Booking Booking Endpoint booknow.php cross site scripting

https://vuldb.com/vuln/355521

Signature, Permissions Required signature permissions-required

VDB-355521 | CTI Indicators (IOB, IOC, TTP, IOA)

https://vuldb.com/vuln/355521/cti

Third Party Advisory third-party-advisory

Submit #786325 | code-projects Online Hotel Booking IN PHP 1.0 Cross Site Scripting

https://vuldb.com/submit/786325

Exploit exploit

https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Reflected%20Cross-Site%20Scripting%20(XSS)%20in%20Online%20Hotel%20Booking%20System%20roomname%20Parameter.md

View Exploit ZIP pw:eip

Product product

https://code-projects.org/

Scores

CVSS v3 4.3

EPSS 0.0036

EPSS Percentile 28.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-79 CWE-94

Status published

Products (1)

code-projects/Online Hotel Booking 1.0

Published Apr 07, 2026

Tracked Since Apr 07, 2026