This vulnerability in eZee Online Hotel Booking Engine allows an attacker with high privileges and requiring user interaction to inject and store malicious scripts due to improper input neutralization during web page generation. When other users access the affected content, the stored scripts can execute, potentially leading to limited confidentiality, integrity, and availability impacts. The CVSS vector indicates network attack vector, low attack complexity, high privileges required, user interaction required, and a scope change with partial impacts on confidentiality, integrity, and availability.

Successful exploitation can lead to execution of arbitrary scripts in the context of affected users, potentially exposing sensitive information, modifying data, or causing denial of service conditions. The impact is limited to partial loss of confidentiality, integrity, and availability as per the CVSS vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, restrict high-privilege user access and validate or sanitize inputs where possible to reduce risk. Monitor vendor communications for updates on fixes or mitigations.