CVE-2026-6820

Name of the Vulnerable Software and Affected Versions VikBooking Hotel Booking Engine & PMS versions prior to 1.8.9

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server. The issue occurs via the email parameter, enabling the injection of arbitrary web scripts that execute when a user accesses an affected page.

Recommendations Update to a version newer than 1.8.8. Restrict the use of the email parameter until the update is applied.