CVE-2026-5705

MEDIUM

code-projects Online Hotel Booking Booking Endpoint booknow.php cross site scripting

Title source: cna

Description

A vulnerability was identified in code-projects Online Hotel Booking 1.0. Affected by this vulnerability is an unknown functionality of the file /booknow.php of the component Booking Endpoint. Such manipulation of the argument roomname leads to cross site scripting. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

References (5)

[Vdb Entry, Technical Description] https://vuldb.com/vuln/355521

[Signature, Permissions Required] https://vuldb.com/vuln/355521/cti

[Third Party Advisory] https://vuldb.com/submit/786325

[Exploit] https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Reflected%20Cross-Site%20Scripting%20(XSS)%20in%20Online%20Hotel%20Booking%20System%20roomname%20Parameter.md

View Exploit ZIP pw:eip

[Product] https://code-projects.org/

Scores

CVSS v3 4.3

EPSS 0.0001

EPSS Percentile 1.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-79 CWE-94

Status published

Products (1)

code-projects/Online Hotel Booking 1.0

Published Apr 07, 2026

Tracked Since Apr 07, 2026