CVE-2026-3763

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A vulnerability was found in code-projects Simple Flight Ticket Booking System 1.0. The affected element is an unknown function of the file showhistory.php. The manipulation results in cross site scripting. It is possible to launch the attack remotely. The exploit has been made public and could be used.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79 CWE-94

Affected software

Vendor	Product	Versions
code-projects	Simple Flight Ticket Booking System	1.0

References

https://code-projects.org/Product
https://github.com/shenxianyuguitian/simple-flight-booking-XSSExploit, Third Party Advisory
https://vuldb.com/?ctiid.349741Permissions Required, VDB Entry
https://vuldb.com/?id.349741Third Party Advisory, VDB Entry
https://vuldb.com/?submit.768182Third Party Advisory, VDB Entry

Timeline

Published: Mar 8, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-376307.3An issue in QuickJS-NG v.0.12.1 allows an attacker to execute arbitrary code via the js_mapped_arguments_mark function CVE-2026-376379.1An issue in Alexantr filemanager v.1.0 allows a remote attacker to execute arbitrary code via the filemanager.php component CVE-2026-37647.3A vulnerability was determined in SourceCodester Client Database Management System 1.0. The impacted element is an unknown function of the f CVE-2026-37659.8A vulnerability was identified in itsourcecode University Management System 1.0. This affects an unknown function of the file /att_single_vi CVE-2026-37665.4A security flaw has been discovered in SourceCodester Web-based Pharmacy Product Management System 1.0. This impacts an unknown function of CVE-2026-37678.8A weakness has been identified in itsourcecode sanitize or validate this input 1.0. Affected is an unknown function of the file /admin/teach CVE-2026-37688.8A security vulnerability has been detected in Tenda F453 1.0.0.3. Affected by this vulnerability is the function formWrlExtraSet of the file CVE-2026-37698.8A vulnerability was detected in Tenda F453 1.0.0.3. Affected by this issue is the function WrlclientSet of the file /goform/WrlclientSet. Th CVE-2026-37708.8A flaw has been found in SourceCodester Computer Laboratory Management System 1.0. This affects an unknown part. This manipulation causes cr CVE-2026-377004.1Cross Site Scripting vulnerability in MaxSite CMS v.109.2 allows a remote attacker to obtain sensitive information via the Backend page file CVE-2026-377099.8Insecure Permissions vulnerability in grokability snipe-it v.8.4.0 and before and fixed after 2026-03-10 commit 676a9958 allows a remote att CVE-2026-37718.8A vulnerability has been found in SourceCodester/janobe Resort Reservation System 1.0. This vulnerability affects unknown code of the file /