This vulnerability affects code-projects Online Hotel Booking 1.0, specifically the /booknow.php file's Booking Endpoint component. An attacker can manipulate the roomname parameter to inject malicious scripts, resulting in cross-site scripting (XSS). The vulnerability is remotely exploitable without privileges and requires user interaction to trigger. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, no confidentiality or availability impact, and low integrity impact. No official remediation or patch has been published as of now.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary scripts in the context of the victim's browser when they interact with the vulnerable parameter. This can lead to session hijacking, defacement, or redirection to malicious sites. However, the impact is limited to integrity and user interaction is required. There is no indication of confidentiality or availability impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider applying input validation and output encoding on the roomname parameter to mitigate XSS risks. Additionally, educating users about the risks of interacting with suspicious links may reduce exploitation likelihood.