Medium severity · published Oct 10, 2025
CVE-2025-60308
code-projects Simple Online Hotel Reservation System 1.0 has a Cross Site Scripting (XSS) vulnerability in the Add Room function of the online hotel reservation system
4.1
CVSS
0.2%
EPSS
No
On KEV
Description
code-projects Simple Online Hotel Reservation System 1.0 has a Cross Site Scripting (XSS) vulnerability in the Add Room function of the online hotel reservation system. Malicious JavaScript code is entered in the Description field, which can leak the administrator's cookie information when browsing this room information
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SO
Simple Online Hotel Reservation System · Fabian
1.0 · source: NVD
Affected product
SO
Simple Online Hotel Reservation System
Fabian
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-60308
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-60308
Exploit
https://github.com/Chen1-Boop/CVE/blob/main/CVE-2025-60308.md
More from Simple Online Hotel Reservation System
9.8
CVE-2025-13170
code-projects Simple Online Hotel Reservation System edit_account.php sql injection
9.8
CVE-2025-13169
code-projects Simple Online Hotel Reservation System add_query_reserve.php sql injection
9.8
CVE-2025-6578
code-projects Simple Online Hotel Reservation System delete_account.php sql injection
9.8
CVE-2025-6451
code-projects Simple Online Hotel Reservation System delete_pending.php sql injection
9.8
CVE-2025-6450
code-projects Simple Online Hotel Reservation System confirm_reserve.php sql injection