CVE-2023-36375
MediumCVSS 5.4Exploitation Probability (EPSS)
Elevated risk52th percentile - higher than 52% of all known CVEs
Summary
The Hostel Management System v2.1 has a Cross Site Scripting vulnerability that allows an attacker to execute arbitrary code via crafted input in the Guardian name, Guardian relation, complimentary address, city, permanent address, and city fields on the Book Hostel & Room Details page.
Risk Assessment
This vulnerability could lead to remote code execution, posing a serious threat to user data security and system integrity.
Recommendation
It is recommended to update the system to the latest version and implement input validation and sanitization to minimize the risk of XSS attacks.
Other vulnerabilities in Hostel Management System v2.1
See all- CVE-2025-11119Medium
itsourcecode Hostel Management System 1.0 has an XSS vulnerability in /justines/index.php in the POST Request Handler component. Manipulating the from argument allows remote attacks. The exploit has been publicly released.
- CVE-2023-36939Medium
The Hostel Management System v2.1 has a Cross-Site Scripting (XSS) vulnerability that allows an attacker to execute arbitrary code via a crafted payload in the search booking field.
Original NVD description (English source)
Cross Site Scripting vulnerability in Hostel Management System v2.1 allows an attacker to execute arbitrary code via a crafted payload to the Guardian name, Guardian relation, complimentary address, city, permanent address, and city parameters in the Book Hostel & Room Details page.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS