---
id: "CVE-2026-116514"
kind: "vulnerability"
aliases: ["CVE-2026-116514"]
title: "itsourcecode Airline Reservation System: XSS via the max argument in book_flight.php"
severity: "medium"
cvss: 5.0
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["airline-reservation-system", "other", "php", "web-app"]
not_affected_if: ["product-not-deployed"]
published_at: "2026-10-26T22:16:54+00:00"
first_seen_at: "2026-10-26T22:25:33+00:00"
updated_at: "2026-10-26T22:28:04+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116514", "first_seen_at": "2026-10-26T22:25:33+00:00"}]
---

# itsourcecode Airline Reservation System: XSS via the max argument in book_flight.php

The itsourcecode Airline Reservation System 1.0 has a cross-site scripting weakness in its /book_flight.php page, reached through the max argument. An attacker can run script in a victim's browser by sending a crafted link, and the exploit is public.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the site runs itsourcecode Airline Reservation System, and whether `/book_flight.php` exists on it
- unknown whether the sources list a specific version range beyond 1.0

## Fix

- unknown: the sources do not name a patched version or vendor fix
- Until a fix exists, restrict access to the application or validate and encode the `max` parameter on output

## Timeline

- 2026-10-26T22:25:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116514

## From the sources

A weakness has been identified in itsourcecode Airline Reservation System 1.0. This affects an unknown part of the file /book_flight.php. Executing a manipulation of the argument max can lead to cross site scripting. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_