{"id":"CVE-2026-116514","kind":"vulnerability","aliases":["CVE-2026-116514"],"related":[],"title":"itsourcecode Airline Reservation System: XSS via the max argument in book_flight.php","description":"A weakness has been identified in itsourcecode Airline Reservation System 1.0. This affects an unknown part of the file /book_flight.php. Executing a manipulation of the argument max can lead to cross site scripting. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.","summary":"The itsourcecode Airline Reservation System 1.0 has a cross-site scripting weakness in its /book_flight.php page, reached through the max argument. An attacker can run script in a victim's browser by sending a crafted link, and the exploit is public.","severity":"medium","cvss":5.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["airline-reservation-system","other","php","web-app"],"not_affected_if":["product-not-deployed"],"how_to_check":"- Check whether the site runs itsourcecode Airline Reservation System, and whether `/book_flight.php` exists on it\n- unknown whether the sources list a specific version range beyond 1.0","fix":"- unknown: the sources do not name a patched version or vendor fix\n- Until a fix exists, restrict access to the application or validate and encode the `max` parameter on output","status":"open","published_at":"2026-10-26T22:16:54+00:00","first_seen_at":"2026-10-26T22:25:33+00:00","triaged_at":"2026-10-26T22:28:04+00:00","updated_at":"2026-10-26T22:28:04+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-26T22:28:04Z","model":"claude-haiku-5-5","output":{"fix":"- unknown: the sources do not name a patched version or vendor fix\n- Until a fix exists, restrict access to the application or validate and encode the `max` parameter on output","reach":"internet","title":"itsourcecode Airline Reservation System: XSS via the max argument in book_flight.php","impact":"medium","summary":"The itsourcecode Airline Reservation System 1.0 has a cross-site scripting weakness in its /book_flight.php page, reached through the max argument. An attacker can run script in a victim's browser by sending a crafted link, and the exploit is public.","category":"other","nicknames":[],"who_cares":["airline-reservation-system","php","web-app"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs script in victim browsers through a crafted link","analyst_note":"Confirm the vulnerable code path and any fixed version at the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-116514 and the vendor's project page.","how_to_check":"- Check whether the site runs itsourcecode Airline Reservation System, and whether `/book_flight.php` exists on it\n- unknown whether the sources list a specific version range beyond 1.0","needs_analyst":true,"not_affected_if":["product-not-deployed"],"who_is_affected":"Any deployment of itsourcecode Airline Reservation System 1.0 that exposes /book_flight.php to users is affected, since the attack is remote. Sites that do not run this product can skip it. The sources do not say whether login is needed to reach the page.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00062,"input_tokens":3309,"output_tokens":578,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116514':14A,17A '-2026':13A,16A '/book_flight.php':42B,88C '1.0':32B,79C 'affect':81C 'airlin':2A,19B,29B,76C 'airline-reservation-system':18B 'app':26B 'argument':9A,48B,94C 'attack':50B,103C,122C 'avail':113C 'book_flight.php':11A 'browser':58B 'could':118C 'craft':62B 'cross':36B,99C 'cross-sit':35B 'cve':12A,15A 'execut':89C,106C 'exploit':66B,109C 'file':87C 'identifi':73C 'itsourcecod':1A,28B,75C 'lead':97C 'link':63B 'made':112C 'manipul':91C 'max':8A,47B,95C 'page':43B 'part':84C 'php':23B 'public':68B,116C 'reach':44B 'remot':107C 'reserv':3A,20B,30B,77C 'run':52B 'script':38B,53B,101C 'send':60B 'site':37B,100C 'system':4A,21B,31B,78C 'unknown':83C 'use':120C 'via':6A 'victim':56B 'weak':39B,70C 'web':25B 'web-app':24B 'xss':5A","nicknames":[],"mitigations":[],"who_affected":"Any deployment of itsourcecode Airline Reservation System 1.0 that exposes /book_flight.php to users is affected, since the attack is remote. Sites that do not run this product can skip it. The sources do not say whether login is needed to reach the page.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T22:16:54+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116514","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116514","severity":null,"published_at":"2026-10-26T22:16:54+00:00","modified_at":"2026-10-26T22:16:54+00:00","first_seen_at":"2026-10-26T22:25:33+00:00","fetched_at":"2026-10-26T22:25:33+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}