CVE-2023-49272
Hotel Management v1.0 - Multiple Reflected Cross-Site Scripting (XSS)
- State
- Published
- Severity
- 5.4 Medium
- Published
- Dec 20, 2023
- Updated
- May 19, 2025
- Reserved
- Nov 24, 2023
Description
Hotel Management v1.0 is vulnerable to multiple authenticated Reflected Cross-Site Scripting vulnerabilities. The 'children' parameter of the reservation.php resource is copied into the HTML document as plain text between tags. Any input is echoed unmodified in the application's response.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.4 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N | Fluid Attacks |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
Hotel ManagementKashipara Group |
|
References
- https://fluidattacks.com/advisories/lang/third-party-advisory
- https://www.kashipara.com/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.