CVE-2026-2160
Stored XSS in SourceCodester Tourism Website save_package Function
Publication date: 2026-02-08
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| oretnom23 | simple_responsive_tourism_website | 1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
[{'type': 'paragraph', 'content': "Exploiting this vulnerability allows attackers to execute malicious scripts in the context of the victim's browser."}, {'type': 'list_item', 'content': 'Steal sensitive information such as session cookies.'}, {'type': 'list_item', 'content': 'Perform unauthorized actions on behalf of the victim.'}, {'type': 'list_item', 'content': 'Deface the website or manipulate its content.'}] [1, 2]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'CVE-2026-2160 is a cross-site scripting (XSS) vulnerability found in the Simple Responsive Tourism Website version 1.0, specifically in the save_package endpoint within the /tourism/classes/Master.php file.'}, {'type': 'paragraph', 'content': "The vulnerability occurs because the Title parameter is not properly validated or encoded, allowing an attacker to inject arbitrary JavaScript code that is then executed in the victim's browser."}, {'type': 'paragraph', 'content': 'This attack can be initiated remotely without authentication and requires user interaction, such as clicking a malicious link.'}] [1, 2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by testing the affected endpoint for cross-site scripting (XSS) by injecting script code into the Title parameter of the /tourism/classes/Master.php?f=save_package URL and observing if the script is executed or reflected unsanitized in the response.'}, {'type': 'paragraph', 'content': 'A simple detection method is to use curl or similar HTTP clients to send a request with a script payload in the Title parameter and check the response for the injected script.'}, {'type': 'list_item', 'content': 'curl -G --data-urlencode "Title=<script>alert(\'XSS\')</script>" "http://target-site/tourism/classes/Master.php?f=save_package"'}, {'type': 'paragraph', 'content': 'If the response contains the injected script without proper encoding or sanitization, the vulnerability is present.'}] [1, 2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include avoiding the use of the affected product or replacing it with a secure alternative, as no known mitigations or countermeasures have been reported.
Additionally, restricting access to the vulnerable endpoint and educating users to avoid clicking on suspicious links can reduce exploitation risk.
Long term, applying proper input validation and output encoding on the Title parameter to neutralize malicious scripts is necessary to fully remediate the issue.