CVE-2026-7089 MEDIUM

CVE-2026-7089: code-projects Home Service System Appointment Booking booking.php cross site scripting

Vendor Code-Projects
Product Home Service System
Weakness CWE-79 · XSS
Published April 27, 2026
Last update April 27, 2026

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction
Confidentiality
Integrity

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

What the vulnerability does

Description

A security vulnerability has been detected in code-projects Home Service System 1.0. The impacted element is an unknown function of the file /booking.php of the component Appointment Booking. The manipulation of the argument fname/lname leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.

Key dates

Disclosure timeline

April 27, 2026 CVE published
April 27, 2026 Record updated