CVE-2026-116514 is a cross-site scripting (XSS) vulnerability in itsourcecode Airline Reservation System version 1.0. The flaw exists in the /book_flight.php file where manipulation of the 'max' argument can lead to XSS. This vulnerability can be exploited remotely and requires user interaction. Public exploit code is available. The CVSS 4.0 base score is 5.3, indicating a medium severity.