A cross-site scripting (XSS) vulnerability exists in itsourcecode Airline Reservation System 1.0 in the /book_flight.php file. The flaw arises from improper handling of the 'max' argument, allowing remote attackers to execute script code. Public exploit code is available. The vulnerability has a medium severity rating with a CVSS score of 4.3.