CVE-2026-13554: itsourcecode Online Hotel Management System POST Request controller.php add cross site scripting
A vulnerability has been found in itsourcecode Online Hotel Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/modamenities/controller.php?action=add of the component POST Request Handler. The manipulation of the argument Name leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-13554?
The severity of CVE-2026-13554 is rated medium with a score of 4.3.
How do I fix CVE-2026-13554?
To fix CVE-2026-13554, sanitize and validate the 'Name' parameter in the POST Request Handler to prevent cross-site scripting.
What type of vulnerability is CVE-2026-13554?
CVE-2026-13554 is a cross-site scripting (XSS) vulnerability.
Which file is affected by CVE-2026-13554?
CVE-2026-13554 affects the file /admin/mod_amenities/controller.php in the itsourcecode Online Hotel Management System.
What can attackers achieve with CVE-2026-13554?
Attackers can exploit CVE-2026-13554 to inject malicious scripts through the vulnerable input field, potentially compromising user sessions.