CVE-2026-6818

Name of the Vulnerable Software and Affected Versions VikBooking Hotel Booking Engine & PMS versions prior to 1.8.9

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server. This occurs via the special requests parameter, enabling the injection of arbitrary web scripts that execute when a user accesses the affected page.

Recommendations Update VikBooking Hotel Booking Engine & PMS to version 1.8.9 or later. As a temporary mitigation, restrict or disable the use of the special requests parameter.