Platform
php
Component
h0202
Fixed in
5.0.1
CVE-2025-14200 describes a cross-site scripting (XSS) vulnerability discovered in Hotel-Management-services-using-MYSQL-and-php. This flaw allows attackers to inject malicious scripts into the application, potentially leading to session hijacking or defacement. The vulnerability affects versions up to 5f8b60a7aa6c06a5632de569d4e3f6a8cd82f76f. Due to the product's rolling release model, a specific patch version is not available.
Successful exploitation of CVE-2025-14200 enables an attacker to inject arbitrary JavaScript code into the Hotel-Management-services-using-MYSQL-and-php application. This code can then be executed in the context of a victim's browser, allowing the attacker to steal session cookies, redirect users to malicious websites, or modify the content of the page. The impact is amplified if the application handles sensitive user data, such as financial information or personal details. Given the nature of XSS, the attack can be launched remotely without requiring any prior authentication. The vulnerability resides within the /usersub.php file, suggesting it relates to user input processing within the request pending page.
This vulnerability has been publicly disclosed, increasing the likelihood of exploitation. The CVSS score is LOW, suggesting the exploit may require specific conditions or user interaction to be successful. No known active campaigns targeting this specific vulnerability have been reported at the time of writing. The vulnerability was disclosed to the vendor on an unspecified date prior to public publication.
Exploit Status
EPSS
0.03% (10% percentile)
CISA SSVC
CVSS Vector
Due to the rolling release nature of Hotel-Management-services-using-MYSQL-and-php, a direct patch is not available. Mitigation strategies should focus on defensive coding practices. Implement strict input validation on all user-supplied data, particularly within the /usersub.php file. Employ robust output encoding to prevent injected scripts from being executed. Consider implementing a Web Application Firewall (WAF) with XSS protection rules to filter out malicious requests. Regularly review and update the application's codebase to address potential vulnerabilities. Without a specific version update, thorough code review and security testing are crucial.
It is recommended to review and sanitize the inputs of the /usersub.php file to prevent the execution of malicious JavaScript code. Because no patched version is available, a patch must be applied manually or the vendor must be contacted for a solution.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2025-14200 is a cross-site scripting (XSS) vulnerability affecting Hotel-Management-services-using-MYSQL-and-php versions up to 5f8b60a7aa6c06a5632de569d4e3f6a8cd82f76f, allowing attackers to inject malicious scripts.
If you are using Hotel-Management-services-using-MYSQL-and-php versions prior to the rolling release, you are potentially affected. Due to the rolling release, a specific fixed version is not available.
Due to the rolling release, a direct patch is not available. Implement input validation, output encoding, and consider a WAF to mitigate the risk.
While no active campaigns are currently confirmed, the vulnerability has been publicly disclosed, increasing the potential for exploitation.
Contact the vendor directly for the most up-to-date advisory information, as a specific advisory may not be publicly available due to the rolling release model.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.