CVE-2026-11338: SourceCodester Ship Ferry Ticket Reservation System manage_user cross site scripting
A security vulnerability has been detected in SourceCodester Ship Ferry Ticket Reservation System 1.0. Impacted is an unknown function of the file /admin/?page=user/manageuser. The manipulation of the argument Username leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
SourceCodester Ship Ferry Ticket Reservation Systemfrom your environment.If the application is not required, uninstall or disable it to eliminate the vulnerable component from the environment.
- Configuration
Implement strict server-side validation/sanitization of the 'Username' parameter and apply proper HTML output encoding/escaping before rendering in the manage_user page to prevent reflected/stored XSS.
SourceCodester Ship Ferry Ticket Reservation System (/admin/?page=user/manage_user) Username input handling = server-side input validation and HTML output encoding - Compensating control
Restrict access to the administrative interface (e.g., /admin/* and specifically /admin/?page=user/manage_user) to trusted IPs or networks via firewall, web server access controls, or require access through a VPN to reduce remote exposure.
- Operational
Review web server and application logs for signs of exploitation of the manage_user Username parameter; invalidate and rotate any administrative session tokens and passwords if compromise is suspected or to be cautious after remediation.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11338?
The severity of CVE-2026-11338 is classified as low, with a score of 2.4.
How do I fix CVE-2026-11338?
To fix CVE-2026-11338, sanitize and validate user inputs to prevent cross site scripting vulnerabilities.
What type of vulnerability is CVE-2026-11338?
CVE-2026-11338 is a Cross Site Scripting (XSS) vulnerability.
Can CVE-2026-11338 be exploited remotely?
Yes, CVE-2026-11338 can be exploited remotely due to its nature in the affected system.
Which software is affected by CVE-2026-11338?
The affected software is the SourceCodester Ship Ferry Ticket Reservation System version 1.0.