This vulnerability involves a cross-site scripting issue in the Hotel and Tourism Reservation System 1.0 by code-projects. Specifically, certain input parameters (name, email, people, number) in the /ht/tour.php file are not properly sanitized, allowing an attacker to inject malicious scripts. The attack vector is remote and does not require privileges or authentication, but does require user interaction. The CVSS 4.0 base score is 5.3, reflecting medium severity with network attack vector, low attack complexity, no privileges required, and user interaction needed. No official fix or patch has been documented.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to session hijacking, defacement, or other client-side attacks. The impact is limited to the affected users who interact with the vulnerable parameters. There is no indication of server-side compromise or data breach from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying input validation or output encoding on the affected parameters as a temporary mitigation. Additionally, users should be cautious when interacting with untrusted inputs in the affected system. Monitor vendor channels for updates regarding an official patch or workaround.