Live › vulnerability › CVE-2026-116514
Go to dashboardThe itsourcecode Airline Reservation System 1.0 has a cross-site scripting weakness in its /book_flight.php page, reached through the max argument. An attacker can run script in a victim's browser by sending a crafted link, and the exploit is public.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 22:25 UTC. All times on this page are UTC.
Any deployment of itsourcecode Airline Reservation System 1.0 that exposes /book_flight.php to users is affected, since the attack is remote. Sites that do not run this product can skip it. The sources do not say whether login is needed to reach the page.
No product ranges from the sources yet.
/book_flight.php exists on itmax parameter on outputEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A weakness has been identified in itsourcecode Airline Reservation System 1.0. This affects an unknown part of the file /book_flight.php. Executing a manipulation of the argument max can lead to cross site scripting. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.
This page as .md · .json · in your agent: get_signal("CVE-2026-116514")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.