CVE-2023-36939
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
The Hostel Management System v2.1 has a Cross-Site Scripting (XSS) vulnerability that allows an attacker to execute arbitrary code via a crafted payload in the search booking field.
Risk Assessment
This vulnerability could lead to account takeover and personal data theft, posing a significant security risk to the organization.
Recommendation
It is recommended to update the system to the latest version to mitigate this vulnerability and implement input sanitization filters in the search field.
Other vulnerabilities in Hostel Management System v2.1
See all- CVE-2025-11119Medium
itsourcecode Hostel Management System 1.0 has an XSS vulnerability in /justines/index.php in the POST Request Handler component. Manipulating the from argument allows remote attacks. The exploit has been publicly released.
- CVE-2023-36375Medium
The Hostel Management System v2.1 has a Cross Site Scripting vulnerability that allows an attacker to execute arbitrary code via crafted input in the Guardian name, Guardian relation, complimentary address, city, permanent address, and city fields on the Book Hostel & Room Details page.
Original NVD description (English source)
Cross-Site Scripting (XSS) vulnerability in Hostel Management System v2.1 allows an attacker to execute arbitrary code via a crafted payload to the search booking field.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS