Threats affecting pkg:github/xmyronn/home-service-system-unauth-stored-xss-admin-takeover-code-project.org-

CVE-2026-7089 is a medium severity cross-site scripting (XSS) vulnerability in code-projects Home Service System version 1.0. The vulnerability exists in an unknown function within the /booking.php file of the Appointment Booking component. It is triggered by manipulation of the fname or lname arguments. The vulnerability can be exploited remotely and requires user interaction. There is no official patch or remediation guidance provided at this time. Public exploit details have been disclosed, but no known active exploitation in the wild has been reported.