CVE-2026-10289
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
A security flaw in code-projects Hotel and Tourism Reservation System 1.0 in file /ht/tour.php allows cross site scripting via manipulation of arguments name, email, people, number. Remote attack is possible and exploit is public.
Risk Assessment
An attacker can inject malicious scripts executed in the victim's browser, leading to session theft or data leakage.
Recommendation
Apply the vendor's patch immediately or disable the vulnerable functionality until an update is available.
Other vulnerabilities in Hotel and Tourism Reservation System
See all- CVE-2026-10290High
In code-projects Hotel and Tourism Reservation System 1.0, SQL injection vulnerability exists in tour.php. A remote attacker can manipulate the GET parameter 'tour', leading to SQL injection. The exploit is publicly available.
- CVE-2026-10288High
In code-projects Hotel and Tourism Reservation System 1.0, the password_verify function in /admin/login.php improperly authenticates the Password argument, leading to improper authentication. The attack is remotely exploitable. The exploit is public.
Original NVD description (English source)
A security flaw has been discovered in code-projects Hotel and Tourism Reservation System 1.0. Impacted is an unknown function of the file /ht/tour.php. Performing a manipulation of the argument name /email /people /number results in cross site scripting. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.