CVE-2026-15346

Name of the Vulnerable Software and Affected Versions VikBooking Hotel Booking Engine & PMS versions prior to 1.8.14

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting (XSS), a technique where malicious scripts are injected into a web page and reflected back to the user. This occurs via the category id parameter. The attack is successful if a user is tricked into clicking a malicious link, though it is limited to browsers that support access keys because the injection occurs within a hidden element.

Recommendations Update to a version newer than 1.8.13. Avoid using the category id parameter in requests until the update is applied.