CVE-2026-86216
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
A security vulnerability has been detected in code-projects Hotel and Tourism Reservation in PHP 1.0. It impacts an unknown function of the file /ht/details.php. Manipulation of the argument room leads to cross site scripting. The attack can be initiated remotely. The exploit has been publicly disclosed and may be used.
Risk Assessment
XSS attack can allow execution of malicious scripts in the user's browser, potentially leading to session theft, account takeover, or malware distribution.
Recommendation
Sanitize and validate input in details.php and implement XSS protection mechanisms such as output encoding.
Other vulnerabilities in Hotel and Tourism Reservation
See all- CVE-2026-86217Medium
A vulnerability was detected in code-projects Hotel and Tourism Reservation in PHP 1.0. It affects an unknown function of the file /ht/hotel_db%20(1).sql in the Database Backup Handler component. The manipulation results in information disclosure. The attack can be launched remotely. The exploit is public and may be used.
- CVE-2026-14764High
A SQL injection vulnerability has been found in the Hotel and Tourism Reservation 1.0 system in the /admin/add_event.php file. An attacker can remotely manipulate the fdetails argument, leading to SQL injection.
- CVE-2026-14763High
A SQL injection vulnerability has been found in the Hotel and Tourism Reservation 1.0 system in the /admin/tour_reserves.php file. An attacker can remotely manipulate the tour argument, leading to SQL code injection. The exploit has been published and may be used.
- CVE-2026-14762High
A SQL Injection vulnerability was found in Hotel and Tourism Reservation 1.0 in the /admin/rooms.php file. An attacker can remotely manipulate the delete argument, leading to SQL injection. The exploit is publicly available.
- CVE-2026-14756High
A SQL injection vulnerability was found in the Hotel and Tourism Reservation 1.0 system in the file /admin/add_tour.php. Manipulation of the delete_image argument allows SQL injection. The attack can be launched remotely and the exploit is publicly available.
- CVE-2026-14755High
A SQL Injection vulnerability has been found in code-projects Hotel and Tourism Reservation 1.0 in the file /admin/reservations.php. The unknown functionality of the Reservations Management Page allows manipulation of the delete argument, enabling remote SQL injection. The exploit has been publicly disclosed.
- CVE-2026-14754High
A SQL injection vulnerability has been found in Hotel and Tourism Reservation 1.0 in the file /admin/add_room.php. An attacker can remotely manipulate arguments delete_image, edit, description, number, price, rooms, or type, leading to unauthorized database access. The exploit has been published and may be used.
Original NVD description (English source)
A security vulnerability has been detected in code-projects Hotel and Tourism Reservation in PHP 1.0. This impacts an unknown function of the file /ht/details.php. The manipulation of the argument room leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS