CVE-2025-11119
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
itsourcecode Hostel Management System 1.0 has an XSS vulnerability in /justines/index.php in the POST Request Handler component. Manipulating the from argument allows remote attacks. The exploit has been publicly released.
Risk Assessment
An attacker can execute scripts in the victim's browser, potentially leading to session theft or content modification.
Recommendation
Apply fixes to eliminate XSS, such as output encoding and input validation, and update the system.
Other vulnerabilities in Hostel Management System
See all- CVE-2023-36939Medium
The Hostel Management System v2.1 has a Cross-Site Scripting (XSS) vulnerability that allows an attacker to execute arbitrary code via a crafted payload in the search booking field.
- CVE-2023-36375Medium
The Hostel Management System v2.1 has a Cross Site Scripting vulnerability that allows an attacker to execute arbitrary code via crafted input in the Guardian name, Guardian relation, complimentary address, city, permanent address, and city fields on the Book Hostel & Room Details page.
Original NVD description (English source)
A security flaw has been discovered in itsourcecode Hostel Management System 1.0. Impacted is an unknown function of the file /justines/index.php of the component POST Request Handler. Performing manipulation of the argument from results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS