CVE-2026-10289

MediumCVSS 4.3/10Last modified Jul 22, 2026

Description

A security flaw has been discovered in code-projects Hotel and Tourism Reservation System 1.0. Impacted is an unknown function of the file /ht/tour.php. Performing a manipulation of the argument name /email /people /number results in cross site scripting. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-79CWE-94

Affected software

No affected versions have been published.

Timeline

Published
Jun 1, 2026
Last modified
Jul 22, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1028939.1Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, GenericOpenIdConnectBackend matches the identity proCVE-2026-1028997.6Sentry is an application monitoring and error tracking platform. From 26.5.0 until 26.7.2, the SAML SSO identity-linking flow allows an attaCVE-2026-10295.4IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site scripting. TCVE-2026-102907.3A weakness has been identified in code-projects Hotel and Tourism Reservation System 1.0. The affected element is an unknown function of theCVE-2026-1029045.4JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterCVE-2026-1029066.3A vulnerability was identified in 0xshariq github-mcp-server up to 52e764a7d66eac1726fce02ca7bb5a638571801a. This issue affects the functionCVE-2026-1029087.3A vulnerability was determined in SourceCodester Online Reviewer Management System 1.0. This issue affects some unknown processing of the fiCVE-2026-1029097.3A vulnerability was identified in SourceCodester Online Reviewer Management System 1.0. Impacted is an unknown function of the file /revieweCVE-2026-102914.3A security vulnerability has been detected in Enderfga claw-orchestrator up to 3.7.0. The impacted element is the function validateRegex of CVE-2026-1029107.3A security flaw has been discovered in SourceCodester Online Reviewer Management System 1.0. The affected element is an unknown function of CVE-2026-1029119.9A flaw has been found in zosmaai pi-llm-wiki up to 0.11.7. Affected is an unknown function of the file mcp/index.ts of the component wiki_caCVE-2026-1029124.7A vulnerability was identified in SourceCodester Online Leave Management System 1.0. This issue affects some unknown processing of the file
CVE-2026-10289: Medium severity, CVSS 4.3 | Vulnix