This vulnerability involves a cross-site scripting issue in the Hotel and Tourism Reservation System 1.0 by code-projects. Specifically, the vulnerability arises from improper handling of input parameters (name, email, people, number) in the /ht/tour.php file, allowing an attacker to inject malicious scripts. The attack vector is network-based with no privileges required and no user interaction needed to initiate the attack, but user interaction is required to trigger the XSS payload. The CVSS 4.0 base score is 5.3, indicating medium severity. The vulnerability is publicly disclosed with an exploit available, but no official fix or patch has been documented.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking, defacement, or other client-side attacks. Since the vulnerability is remotely exploitable and user interaction is required, the impact is limited to users who interact with maliciously crafted input. There is no indication of privilege escalation or server-side compromise from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation and output encoding on the affected parameters (name, email, people, number) in /ht/tour.php to mitigate XSS risks. Additionally, employing web application firewalls (WAFs) that detect and block XSS payloads may reduce exposure. Monitor vendor channels for updates regarding an official patch or remediation.