Cross-Site Scripting Vulnerability in cgpandey Hotelmis HTTP GET Request Handler
CVE-2025-7800

5.1MEDIUM

Key Information:

Vendor

Cgpandey

Status
Hotelmis
Vendor
CVE Published:
18 July 2025

What is CVE-2025-7800?

A cross-site scripting vulnerability exists in cgpandey Hotelmis due to improper handling of user input in the HTTP GET Request Handler component. This vulnerability allows attackers to manipulate the Search argument in the admin.php file, potentially leading to unauthorized script execution. As this product uses a rolling release model for continuous delivery, specific version details of affected releases are not provided, making it crucial for users to remain vigilant with their security updates.

Affected Version(s)

hotelmis c572198e6c4780fccc63b1d3e8f3f72f825fc94e

References

https://vuldb.com/?id.316864
vdb-entrytechnical-description
https://vuldb.com/?ctiid.316864
signaturepermissions-required
https://vuldb.com/?submit.616838
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

dev03303 (VulDB User)
.
CVE-2025-7800 : Cross-Site Scripting Vulnerability in cgpandey Hotelmis HTTP GET Request Handler