CVE-2026-7089 - Vulnerability Analysis

Overview

code-projects Home Service System 1.0 contains a stored XSS caused by manipulation of "fname" and "lname" arguments in /booking.php Appointment Booking component, letting remote attackers execute scripts, exploit requires crafted input.

Severity & Score

Impact

Remote attackers can execute arbitrary scripts in users' browsers, potentially stealing data or performing actions on their behalf.

Mitigation

Update to the latest version.

References

• https://vuldb.com/vuln/359664
• https://vuldb.com/vuln/359664/cti
• https://code-projects.org/
• https://github.com/Xmyronn/home-service-system-unauth-stored-xss-admin-takeover-code-project.org-.git
• https://vuldb.com/submit/800121

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner