Medium severity · published Dec 20, 2023
CVE-2023-49269
Hotel Management v1.0 - Multiple Reflected Cross-Site Scripting (XSS)
5.4
CVSS
0.4%
EPSS
No
On KEV
Description
Hotel Management v1.0 is vulnerable to multiple authenticated Reflected Cross-Site Scripting vulnerabilities. The 'adults' parameter of the reservation.php resource is copied into the HTML document as plain text between tags. Any input is echoed unmodified in the application's response.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HM
Hotel Management · Kashipara Group
1.0 · source: vendor
HM
Hotel Management System · Jayesh
1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-49269
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-49269
Exploit
https://fluidattacks.com/advisories/lang/
Product
https://www.kashipara.com/
More from Hotel Management
5.4
CVE-2023-49272
Hotel Management v1.0 - Multiple Reflected Cross-Site Scripting (XSS)
5.4
CVE-2023-49271
Hotel Management v1.0 - Multiple Reflected Cross-Site Scripting (XSS)
5.4
CVE-2023-49270
Hotel Management v1.0 - Multiple Reflected Cross-Site Scripting (XSS)