Medium severity · published Mar 9, 2026
CVE-2026-3819
SourceCodester Resort Reservation System Reservation Management page cross site scripting
5.4
CVSS
0.3%
EPSS
No
On KEV
Description
A vulnerability has been found in SourceCodester Resort Reservation System 1.0. The affected element is an unknown function of the file /?page=manage_reservation of the component Reservation Management Module. Such manipulation of the argument ID leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 20% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RR
Resort Reservation System · SourceCodester
1.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-3819
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-3819
Exploit
https://medium.com/@rvpipalwa/stored-cross-site-scripting-xss-in-reservation-management-sourcecodester-resort-reservation-894ee77d7312
Permissions Required
https://vuldb.com/?ctiid.349785
Third Party Advisory
https://vuldb.com/?id.349785
Third Party Advisory
https://vuldb.com/?submit.769578
Product
https://www.sourcecodester.com/
More from Resort Reservation System
8.8
CVE-2026-3806
SourceCodester/janobe Resort Reservation System room_rates.php sql injection
8.8
CVE-2026-3800
SourceCodester/janobe Resort Reservation System controller.php doInsert unrestricted upload
8.8
CVE-2026-3771
SourceCodester/janobe Resort Reservation System accomodation.php sql injection