Description
A vulnerability was detected in code-projects Online Product Reservation System 1.0. The affected element is an unknown function of the file handgunner-administrator/prod.php. Performing a manipulation of the argument cat results in cross site scripting. The attack is possible to be carried out remotely. The exploit is now public and may be used.
Affected products
fabian: online product reservation system
References6
- github.com/foeCat/CVE/blob/main/OnlineProductReservation_PHP/xs… ExploitThird Party Advisory
- github.com/foeCat/CVE/blob/main/OnlineProductReservation_PHP/xs… ExploitThird Party Advisory
- code-projects.org/ Product
- vuldb.com/?ctiid.339478 Permissions RequiredVDB Entry
- vuldb.com/?id.339478 Third Party AdvisoryVDB Entry
- vuldb.com/?submit.731098 Third Party AdvisoryVDB Entry
Metrics
- CVSS 3.1
-
6.1
MEDIUM
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 4.0
-
2.1
LOW
Score source: CNA
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - EPSS — exploit probability
- 0% percentile: 32 · as of 11 November 2026
- CWE
- CWE-79CWE-94
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.