CVE-2026-116514: itsourcecode Airline Reservation System book_flight.php cross site scripting
A weakness has been identified in itsourcecode Airline Reservation System 1.0. This affects an unknown part of the file /bookflight.php. Executing a manipulation of the argument max can lead to cross site scripting. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attack can be executed remotely without privileges, but it requires user interaction. An attacker would need to cause a user to process a crafted request involving the max argument in /book_flight.php.
What is the likely security impact?
The supplied CVSS vector indicates integrity impact only, with no reported confidentiality or availability impact. Successful exploitation is cross-site scripting, so attacker-controlled script may execute in the affected user's browser context.
Is public exploit code available?
Yes. The vulnerability data states that an exploit has been made publicly available and could be used in attacks.