CVE-2026-5705
code-projects Online Hotel Booking Booking Endpoint booknow.php cross site scripting
CVSS Score
4.3
EPSS Score
0.0%
EPSS Percentile
1th
A vulnerability was identified in code-projects Online Hotel Booking 1.0. Affected by this vulnerability is an unknown functionality of the file /booknow.php of the component Booking Endpoint. Such manipulation of the argument roomname leads to cross site scripting. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
| CWE | CWE-79 CWE-94 |
| Vendor | code-projects |
| Product | online hotel booking |
| Published | Apr 6, 2026 |
| Last Updated | Apr 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for code-projects online hotel booking
Be the first to know when new medium vulnerabilities affecting code-projects online hotel booking are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
code-projects / Online Hotel Booking
1.0
References
vuldb.com: https://vuldb.com/vuln/355521 vuldb.com: https://vuldb.com/vuln/355521/cti vuldb.com: https://vuldb.com/submit/786325 github.com: https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Reflected%20Cross-Site%20Scripting%20(XSS)%20in%20Online%20Hotel%20Booking%20System%20roomname%20Parameter.md code-projects.org: https://code-projects.org/
Credits
🔍 AhmadMarzouk (VulDB User)