Is CVE-2026-10289 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-10289 being exploited in the wild.

How severe is CVE-2026-10289?

Medium severity, with a CVSS score of 4.3, published 1 June 2026.

Is there a fix for CVE-2026-10289?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-10289 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-10289?

Check whether you run Code-Projects Hotel and Tourism Reservation System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-10289: code-projects Hotel and Tourism Reservation System stored XSS in tour.php

CVE-2026-10289 · Severity: medium · CVSS 4.3 · Published 2026-06-01

A security vulnerability exists in the Hotel and Tourism Reservation System, a software package used for managing travel and lodging bookings. An attacker can submit malicious scripts through the public booking form which are then stored and executed when an administrator views the reservation list. This could allow an attacker to hijack administrative sessions, steal credentials, or perform unauthorized actions on the platform.

Technologies: Code-Projects Hotel and Tourism Reservation System. Vendors: Code-Projects.

Quick answers

Is CVE-2026-10289 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-10289 being exploited in the wild.
How severe is CVE-2026-10289?: Medium severity, with a CVSS score of 4.3, published 1 June 2026.
Which products and versions are affected?: Code-Projects Hotel and Tourism Reservation System 1.0.
Is there a fix for CVE-2026-10289?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-10289 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-10289?: Check whether you run Code-Projects Hotel and Tourism Reservation System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored cross-site scripting (XSS) vulnerability exists in code-projects Hotel and Tourism Reservation System 1.0. The flaw is located in the tour booking functionality within /ht/tour.php, where the 'name', 'email', 'people', and 'number' parameters are accepted via POST requests without proper sanitization. These inputs are stored directly in the 'hotel_db' database. When an authenticated administrator accesses the management panel at /ht/admin/tour_reserves.php, the application renders the malicious payload without output encoding. This allows unauthenticated remote attackers to execute arbitrary JavaScript in the admin's browser session, potentially leading to session hijacking or full account takeover. A public exploit is available.

Affected products

code-projects Hotel and Tourism Reservation System 1.0

Timeline

2026-06-01: disclosed
2026-06-01: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.