CVE-2026-5705 is a cross-site scripting (XSS) vulnerability in code-projects Online Hotel Booking version 1.0, specifically affecting the /booknow.php booking endpoint where the roomname parameter is insufficiently sanitized. This flaw allows attackers to inject malicious scripts that execute in users' browsers when processing booking requests. The vulnerability carries a CVSS score of 4.3 (Medium severity) with a network-based attack vector requiring no privileges but necessitating user interaction. The attack has low complexity and impacts only the integrity of the affected system, with no potential for data confidentiality loss or service disruption. The FAUCET risk score of 38.0/100 places this as a moderate-risk concern. Public exploit code is available for this vulnerability, indicating active disclosure of proof-of-concept materials. However, the vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities catalog and shows minimal community engagement based on the inactive Hot List status. The extremely low EPSS score of 0.00012 suggests minimal real-world exploitation likelihood compared to other disclosed vulnerabilities.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| Code-Projects | Online Hotel Booking | 1.0CNA affected |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.