The vulnerability CVE-2025-65132 affects alandsilva26 hotel-management-php 1.0. It is a Cross Site Scripting (XSS) issue located in the /public/admin/edit_room.php endpoint. Specifically, the room_id GET parameter is vulnerable to injection of malicious JavaScript, which can be executed by unsuspecting users. No CVSS score or vendor patch information is available, and no known exploits in the wild have been reported.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the affected web application, potentially leading to session hijacking, defacement, or other client-side attacks. The impact is limited to the scope of the XSS vulnerability and depends on the victim's interaction with the malicious payload.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the absence of an official fix, users should consider implementing input validation and output encoding on the room_id parameter to prevent script injection. Monitoring for updates from the vendor or project maintainer is recommended.