CVE-2026-86216: code-projects Hotel and Tourism Reservation in PHP details.php cross site scripting
A security vulnerability has been detected in code-projects Hotel and Tourism Reservation in PHP 1.0. This impacts an unknown function of the file /ht/details.php. The manipulation of the argument room leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker can initiate the attack remotely by manipulating the room argument sent to /ht/details.php. No authentication requirement is stated, but exploitation requires a victim to interact with the crafted content, as reflected by the UI:R metric.
Is public exploit information available?
Yes. The exploit has been publicly disclosed and may be used.
How can I determine whether an installation is affected?
Check whether the application is code-projects Hotel and Tourism Reservation in PHP version 1.0 and whether /ht/details.php accepts and renders the room argument without sufficient output encoding or input handling.