Executive brief
HubCore is a destination management and booking platform used by tour operators and travel agencies to manage tourism products and customer reservations. A reflected cross-site scripting vulnerability in the login page allows attackers to inject malicious JavaScript that executes in users' browsers, potentially stealing credentials, session tokens, or redirecting users to fraudulent sites—no authentication is required to exploit this flaw.
Technical details
This is a reflected XSS vulnerability in the /loginController/doLogin endpoint of HubCore platform version 14.1.1. The vulnerability exists because the language POST parameter is not properly sanitized before being included in the application's response. An unauthenticated remote attacker can craft a malicious request with JavaScript payload in the language parameter, causing the server to reflect it directly into the response without encoding. When a victim visits a crafted link or submits a form, their browser executes the injected script. No patch has been publicly announced as of the advisory date.
Affected products
- HubCore HubCore Platform 14.1.1
Timeline
- 2026-09-04: disclosed