CVE-2025-14200

13th percentile - higher than 13% of all known CVEs

A vulnerability has been found in alokjaiswal Hotel-Management-services-using-MYSQL-and-php up to 5f8b60a7aa6c06a5632de569d4e3f6a8cd82f76f in an unknown function of the file /usersub.php of the Request Pending Page component. The manipulation leads to cross site scripting. The attack can be initiated remotely, and the exploit has been publicly disclosed.

A remote attacker could exploit the vulnerability to conduct a cross-site scripting attack, potentially leading to session theft or execution of malicious code in the user's browser. The exploit is publicly available, increasing the risk.

It is recommended to update to the latest version, as the product uses a rolling release model and the vendor did not respond to the disclosure. In the meantime, consider implementing mitigations.