CVE-2026-13556
itsourcecode Online Hotel Management System POST Request controller.php edit cross site scripting
- State
- Published
- Severity
- 5.3 Medium
- Published
- Jun 29, 2026
- Updated
- Jul 1, 2026
- Reserved
- Jun 28, 2026
Description
A vulnerability was determined in itsourcecode Online Hotel Management System 1.0. This affects an unknown part of the file /admin/mod_users/controller.php?action=edit of the component POST Request Handler. This manipulation of the argument Name causes cross site scripting. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R | VulDB |
| 3.0 | 4.3 Medium | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R | VulDB |
| 2.0 | 5.0 Medium | AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
Online Hotel Management Systemitsourcecode |
|
References
- VDB-374564 | itsourcecode Online Hotel Management System POST Request controller.php edit cross site scriptingvdb-entrytechnical-description
- VDB-374564 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- CVE-2026-13556 | CVE Analysis and Reportthird-party-advisory
- Submit #843586 | itsourcecode Online Hotel Management System v1.0 Storage XSS vulnerabilitythird-party-advisory
- https://github.com/Hh-176/CVE/issues/7exploitissue-tracking
- https://itsourcecode.com/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.