Platform
php
Component
h0202
Fixed in
5.0.1
A cross-site scripting (XSS) vulnerability has been identified in Hotel-Management-services-using-MYSQL-and-php, affecting versions up to 5f8b60a7aa6c06a5632de569d4e3f6a8cd82f76f. This vulnerability allows attackers to inject malicious scripts into the application, potentially compromising user sessions and data. Due to the product's rolling release model, specific affected and updated versions are not available. Mitigation strategies focus on input validation and output encoding.
Successful exploitation of CVE-2025-14201 allows an attacker to execute arbitrary JavaScript code within the context of a user's browser session. This can lead to various malicious actions, including session hijacking, phishing attacks, and defacement of the application's user interface. The attacker could steal sensitive information, such as user credentials or personal data, and potentially gain unauthorized access to the underlying system. Given the public availability of an exploit, the risk of exploitation is elevated, particularly for systems with inadequate security controls. The impact is amplified if the application handles sensitive data or is integrated with other critical systems.
The vulnerability is publicly disclosed and an exploit is available, indicating a higher probability of exploitation. The CVE was published on 2025-12-07. The vendor was notified early about the issue. The EPSS score is pending evaluation, but the public exploit suggests a medium to high probability of exploitation depending on the prevalence of the vulnerable software.
Exploit Status
EPSS
0.04% (13% percentile)
CISA SSVC
CVSS Vector
Due to the rolling release nature of Hotel-Management-services-using-MYSQL-and-php, a direct patch is not immediately available. The primary mitigation strategy involves implementing robust input validation and output encoding techniques within the /dishsub.php file. Specifically, sanitize the 'item.name' parameter to prevent the injection of malicious scripts. Consider using a Web Application Firewall (WAF) to filter out potentially malicious requests. Regularly review and update the application's codebase to address any potential vulnerabilities. Implement strict content security policy (CSP) headers to restrict the sources from which scripts can be executed. After implementing these mitigations, thoroughly test the application to ensure that the vulnerability has been effectively addressed.
It is recommended to review and sanitize user inputs in the /dishsub.php file, specifically the item.name parameter, to prevent the injection of malicious code. Implement validation and encoding of user input to prevent Cross-Site Scripting (XSS) attacks.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2025-14201 is a cross-site scripting (XSS) vulnerability affecting Hotel-Management-services-using-MYSQL-and-php versions up to 5f8b60a7aa6c06a5632de569d4e3f6a8cd82f76f, allowing attackers to inject malicious scripts.
If you are using Hotel-Management-services-using-MYSQL-and-php versions up to 5f8b60a7aa6c06a5632de569d4e3f6a8cd82f76f, you are potentially affected by this vulnerability.
Due to the rolling release model, a direct patch is unavailable. Implement input validation and output encoding in /dishsub.php, and consider using a WAF and CSP.
Yes, a public exploit is available, indicating a higher probability of active exploitation.
Contact the vendor directly as specific version details and advisories are not publicly available due to the rolling release model.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.