The vulnerability CVE-2026-13556 affects itsourcecode Online Hotel Management System version 1.0. It is a cross-site scripting (XSS) issue caused by improper sanitization of the 'Name' parameter in the POST request handler located in /admin/mod_users/controller.php?action=edit. An attacker can remotely exploit this by injecting malicious scripts via the 'Name' argument, potentially leading to script execution in the context of the affected application. The vulnerability has been publicly disclosed, but no official fix or patch is currently available.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to session hijacking, defacement, or other client-side attacks. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and limited impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying input validation or sanitization controls on the 'Name' parameter in the POST request handler to mitigate exploitation. Monitoring for suspicious activity related to this endpoint is advisable.