CVE-2026-15401

Name of the Vulnerable Software and Affected Versions VikBooking Hotel Booking Engine & PMS versions prior to 1.8.14

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server. The issue occurs via the vbfX parameter, which is stored through the public-facing saveorder task. Because this task lacks default capability or authentication checks, attackers can inject arbitrary web scripts that execute when a user accesses the affected page.

Recommendations Update VikBooking Hotel Booking Engine & PMS to version 1.8.14 or later. As a temporary mitigation, restrict access to the saveorder task to prevent unauthenticated submissions to the vbfX parameter.