The vulnerability CVE-2026-13556 affects itsourcecode Online Hotel Management System 1.0. It is a cross-site scripting flaw in the POST request handler of the /admin/mod_users/controller.php?action=edit component. Specifically, the 'Name' parameter is not properly sanitized, allowing an attacker to inject malicious scripts. This vulnerability can be exploited remotely without privileges and requires user interaction. The vulnerability has been publicly disclosed but no known exploits are reported in the wild. No official fix or remediation guidance is currently available.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary scripts in the context of the affected web application for users who interact with the vulnerable functionality. This can lead to session hijacking, defacement, or other client-side attacks. The impact is limited by the requirement for user interaction and the lack of privilege requirements.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor for vendor updates. As a temporary measure, consider applying input validation or sanitization on the 'Name' parameter if possible.