CVE-2026-86216: Cross Site Scripting in code-projects Hotel and Tourism Reservation in PHP

This vulnerability allows an attacker to perform cross-site scripting (XSS) by manipulating the 'room' argument in the /ht/details.php file of the Hotel and Tourism Reservation in PHP version 1.0. The vulnerability is remotely exploitable without privileges and requires user interaction. The vulnerability has been publicly disclosed but there is no indication of active exploitation in the wild. No patch or remediation information is provided.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to session hijacking, defacement, or other client-side attacks. However, the vulnerability requires user interaction and does not provide direct system access or privilege escalation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor vendor communications for updates. Until a patch is available, consider implementing input validation or output encoding on the 'room' parameter to mitigate XSS risks.