CVE-2021-42662

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-11-05 · updated 2026-06-17
Weakness: CWE-79

Description

A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Online Event Booking and Reservation System in PHP/MySQL via the Holiday reason parameter. An attacker can leverage this vulnerability in order to run javascript commands on the web server surfers behalf, which can lead to cookie stealing and more.

Affected products

Online Event Booking And Reservation System Project Online Event Booking And Reservation System: 2.3.0

References

http://packetstormsecurity.com/files/164615/Online-Event-Booking-And-Reservation-System-1.0-Cross-Site-Scripting.html
https://github.com/TheHackingRabbi/CVE-2021-42662
https://www.exploit-db.com/exploits/50450
https://www.sourcecodester.com/php/14241/online-event-booking-and-reservation-system-phpmysql.html
http://packetstormsecurity.com/files/164615/Online-Event-Booking-And-Reservation-System-1.0-Cross-Site-Scripting.html
https://github.com/TheHackingRabbi/CVE-2021-42662
https://www.exploit-db.com/exploits/50450
https://www.sourcecodester.com/php/14241/online-event-booking-and-reservation-system-phpmysql.html

Get alerted when CVE-2021-42662 or the next vulnerability affects your stack