# CVE-2026-13557: itsourcecode Online Hotel Management System stored XSS in mod_room

Source: https://junglewise.ai/threats/cve-2026-13557-itsourcecode-online-hotel-management-system-stored-xss-in-mod  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-29. Updated: 2026-06-29  
License: CC BY 4.0 with a link back

CVE-2026-13557 · Severity: medium · CVSS 4.3 · Published 2026-06-29

A security vulnerability exists in the itsourcecode Online Hotel Management System, a software package used for managing hotel bookings and operations. An attacker can inject malicious scripts into the system's database by submitting a specially crafted room name. If a staff member or administrator views the affected room entry, the script could execute in their browser, potentially leading to unauthorized actions or the theft of sensitive session information.

Technologies: [Itsourcecode Online Hotel Management System](https://junglewise.ai/threats/technologies/online-hotel-management-system). Vendors: [Itsourcecode](https://junglewise.ai/threats/vendors/itsourcecode).

## Quick answers

**Is CVE-2026-13557 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-13557 being exploited in the wild.

**How severe is CVE-2026-13557?** Medium severity, with a CVSS score of 4.3, published 29 June 2026.

**Which products and versions are affected?** Itsourcecode Online Hotel Management System 1.0.

**Is there a fix for CVE-2026-13557?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-13557 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-13557?** Check whether you run Itsourcecode Online Hotel Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored cross-site scripting (XSS) vulnerability exists in itsourcecode Online Hotel Management System 1.0 within the /admin/mod_room/controller.php script. The application fails to properly sanitize or escape the 'name' POST parameter when the 'action' is set to 'add'. This allows a remote attacker to submit a malicious payload (e.g., an image tag with an onerror attribute) that is permanently stored in the 'room' database table. When an administrative user subsequently views the room list or details, the payload is rendered without encoding, leading to arbitrary JavaScript execution in the victim's browser session. This can be used for session hijacking or credential theft. No authentication is reportedly required to reach the vulnerable endpoint in the default configuration.

## Affected products

- itsourcecode Online Hotel Management System 1.0

## Timeline

- 2026-05-30: disclosed: Vulnerability details and PoC shared on GitHub
- 2026-06-29: advisory: CVE published and NVD record created

## References

- [https://github.com/Hh-176/CVE/issues/8](https://github.com/Hh-176/CVE/issues/8)
- [https://itsourcecode.com/](https://itsourcecode.com/)
- [https://vuldb.com/cve/CVE-2026-13557](https://vuldb.com/cve/CVE-2026-13557)
- [https://vuldb.com/submit/843587](https://vuldb.com/submit/843587)
- [https://vuldb.com/vuln/374565](https://vuldb.com/vuln/374565)
- [https://vuldb.com/vuln/374565/cti](https://vuldb.com/vuln/374565/cti)

## Related threats

- [itsourcecode Online Hotel Management System SQL injection in login.php](https://junglewise.ai/threats/cve-2026-14688-itsourcecode-online-hotel-management-system-sql-injection-in)
- [itsourcecode Online Hotel Management System stored XSS in mod_users](https://junglewise.ai/threats/cve-2026-13556-itsourcecode-online-hotel-management-system-stored-xss-in-mod)
- [itsourcecode Online Hotel Management System SQL injection in controller.php](https://junglewise.ai/threats/cve-2026-13555-itsourcecode-online-hotel-management-system-sql-injection-in)
- [itsourcecode Online Hotel Management System stored XSS in controller.php](https://junglewise.ai/threats/cve-2026-13554-itsourcecode-online-hotel-management-system-stored-xss-in)
- [itsourcecode Online Hotel Management System unrestricted upload in mod_amenities](https://junglewise.ai/threats/cve-2026-13553-itsourcecode-online-hotel-management-system-unrestricted-upload)