{"id":"CVE-2026-13556","state":"PUBLISHED","title":"itsourcecode Online Hotel Management System POST Request controller.php edit cross site scripting","description":"A vulnerability was determined in itsourcecode Online Hotel Management System 1.0. This affects an unknown part of the file /admin/mod_users/controller.php?action=edit of the component POST Request Handler. This manipulation of the argument Name causes cross site scripting. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.","publishedAt":"2026-06-29T09:45:07.318Z","updatedAt":"2026-07-01T13:52:21.080Z","severity":{"score":5.3,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["itsourcecode Online Hotel Management System"],"affected":[{"vendor":"itsourcecode","product":"Online Hotel Management System","versions":[{"version":"1.0","status":"affected"}],"cpes":["cpe:2.3:a:itsourcecode:online_hotel_management_system:*:*:*:*:*:*:*:*"],"modules":["POST Request Handler"]}],"references":["https://vuldb.com/vuln/374564","https://vuldb.com/vuln/374564/cti","https://vuldb.com/cve/CVE-2026-13556","https://vuldb.com/submit/843586","https://github.com/Hh-176/CVE/issues/7","https://itsourcecode.com/"],"weaknesses":["CWE-79","CWE-94"],"ingestedAt":"2026-10-29T20:11:00.674Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/13xxx/CVE-2026-13556.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-13556","state":"PUBLISHED","datePublished":"2026-06-29T09:45:07.318Z","dateUpdated":"2026-07-01T13:52:21.080Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2026-06-28T16:02:39.738Z"},"containers":{"cna":{"title":"itsourcecode Online Hotel Management System POST Request controller.php edit cross site scripting","descriptions":[{"lang":"en","value":"A vulnerability was determined in itsourcecode Online Hotel Management System 1.0. This affects an unknown part of the file /admin/mod_users/controller.php?action=edit of the component POST Request Handler. This manipulation of the argument Name causes cross site scripting. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized."}],"affected":[{"vendor":"itsourcecode","product":"Online Hotel Management System","versions":[{"version":"1.0","status":"affected"}],"cpes":["cpe:2.3:a:itsourcecode:online_hotel_management_system:*:*:*:*:*:*:*:*"],"modules":["POST Request Handler"]}],"references":[{"url":"https://vuldb.com/vuln/374564","name":"VDB-374564 | itsourcecode Online Hotel Management System POST Request controller.php edit cross site scripting","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/374564/cti","name":"VDB-374564 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/cve/CVE-2026-13556","name":"CVE-2026-13556 | CVE Analysis and Report","tags":["third-party-advisory"]},{"url":"https://vuldb.com/submit/843586","name":"Submit #843586 | itsourcecode Online Hotel Management System v1.0 Storage XSS vulnerability","tags":["third-party-advisory"]},{"url":"https://github.com/Hh-176/CVE/issues/7","tags":["exploit","issue-tracking"]},{"url":"https://itsourcecode.com/","tags":["product"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":4.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":4.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":5,"vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","type":"CWE","lang":"en","description":"Cross Site Scripting"}]},{"descriptions":[{"cweId":"CWE-94","type":"CWE","lang":"en","description":"Code Injection"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2026-06-29T09:45:07.318Z"},"timeline":[{"time":"2026-06-28T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2026-06-28T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2026-06-28T18:07:58.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"Hh-176 (VulDB User)","type":"reporter"}],"tags":["x_freeware"]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-07-01T13:51:50.935966Z","id":"CVE-2026-13556","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-07-01T13:52:21.080Z"}}]}}}