CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xtreeme Planyo online reservation system planyo-online-reservation-system allows Stored XSS.This issue affects Planyo online reservation system: from n/a through <= 3.1.
Explanation of Vulnerability in Simple Terms
Planyo online reservation system versions 3.1 and earlier contain a cross-site scripting vulnerability. An attacker with low-level user access can inject malicious scripts that execute in other users' browsers when they view affected pages. The vulnerability requires user interaction and can affect confidentiality, integrity, and availability across the application scope.
What an attacker can do
Inject malicious scripts that run in other users' browsers to steal data, modify content, or disrupt the reservation system.
Potential impact on your site
Users' sessions and data are at risk; attackers can impersonate users, steal booking information, or deface the reservation interface.
Conditions required to exploit
Attacker needs a low-privilege user account and must trick a victim into viewing a page containing the malicious payload.
Key dates
External resources
