CVE-2026-2160

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A vulnerability has been found in SourceCodester Simple Responsive Tourism Website 1.0. Affected by this vulnerability is an unknown functionality of the file /tourism/classes/Master.php?f=save_package. The manipulation of the argument Title leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79 CWE-94

Affected software

Vendor	Product	Versions
SourceCodester	Simple Responsive Tourism Website	1.0

References

https://github.com/CH0ico/CVE_choco_6/blob/main/report.mdExploit, Issue Tracking
https://vuldb.com/?ctiid.344862Permissions Required, VDB Entry
https://vuldb.com/?id.344862Third Party Advisory, VDB Entry
https://vuldb.com/?submit.751016Third Party Advisory, VDB Entry
https://www.sourcecodester.com/Product

Timeline

Published: Feb 8, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-21619.8A vulnerability was found in itsourcecode Directory Management System 1.0. Affected by this issue is some unknown functionality of the file CVE-2026-216186.1Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in hexpm hexpm/hexpm ('Elixir.Hexp CVE-2026-216197.5Uncontrolled Resource Consumption, Deserialization of Untrusted Data vulnerability in hexpm hex_core (hex_api modules), hexpm hex (mix_hex_a CVE-2026-21627.2A vulnerability was determined in itsourcecode News Portal Project 1.0. This affects an unknown part of the file /admin/aboutus.php. This ma CVE-2026-216202.3Relative Path Traversal, Improper Isolation or Compartmentalization vulnerability in erlang otp erlang/otp (tftp_file modules), erlang otp i CVE-2026-216215.3Incorrect Authorization vulnerability in hexpm hexpm/hexpm ('Elixir.HexpmWeb.API.OAuthController' module) allows Privilege Escalation. An A CVE-2026-216229.8Insufficient Session Expiration vulnerability in hexpm hexpm/hexpm ('Elixir.Hexpm.Accounts.PasswordReset' module) allows Account Takeover. CVE-2026-216235.4Lack of input filterung leads to a persistent XSS vulnerability in the forum post handling of the Easy Discuss component for Joomla.CVE-2026-216245.4Lack of input filterung leads to a persistent XSS vulnerability in the user avatar text handling of the Easy Discuss component for Joomla.CVE-2026-216258.8User provided uploads to the Easy Discuss component for Joomla aren't properly validated. Uploads are purely checked by file extensions, no CVE-2026-216267.5Access control settings for forum post custom fields are not applied to the JSON output type, leading to an ACL violation vector an informat CVE-2026-216279.5The vulnerability was rooted in how the Tassos Framework plugin handled specific AJAX requests through Joomla’s com_ajax entry point. Under