PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-13554 itsourcecode CVE debrief

CVE-2026-13554 is a cross site scripting vulnerability found in itsourcecode Online Hotel Management System 1.0. The vulnerability affects an unknown functionality of the file /admin/mod_amenities/controller.php?action=add, specifically in the POST Request Handler. The manipulation of the argument Name leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Evidence is limited; further investigation is required to determine the full scope of affected systems and potential impact.

Vendor
itsourcecode
Product
Online Hotel Management System
CVSS
LOW 2.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-29
Original CVE updated
2026-06-29
Advisory published
2026-06-29
Advisory updated
2026-06-29

Who should care

Defenders of itsourcecode Online Hotel Management System 1.0 instances should prioritize reviewing and updating their systems to mitigate this vulnerability. Due to the remote attack vector and public exploit disclosure, immediate attention is advised. Organizations using similar systems should also assess their exposure.

Technical summary

The vulnerability exists in the /admin/mod_amenities/controller.php?action=add file of itsourcecode Online Hotel Management System 1.0. The POST Request Handler does not properly sanitize user input in the Name argument, leading to cross site scripting. The CVSS score is 2.1, indicating a low severity. However, the remote attack vector and public exploit availability increase the urgency for patching.

Defensive priority

Apply patches or mitigations immediately due to public exploit disclosure and remote attack vector. Review system configurations and update as necessary.

Recommended defensive actions

  • Apply official patches or updates for itsourcecode Online Hotel Management System 1.0
  • Implement input validation and output encoding for user-supplied data
  • Conduct thorough inventory checks for affected systems
  • Enhance monitoring for suspicious activity related to /admin/mod_amenities/controller.php?action=add
  • Consider compensating controls for systems that cannot be patched immediately

Evidence notes

The CVE and NVD provide official details on this vulnerability. Additional sources, including Vuldb and GitHub, offer further context and potential exploit information. However, evidence is limited, and further investigation is required to determine the full scope of affected systems and potential impact.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-13554 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-13554

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-13554 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-13554

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.