CVE-2026-7089: code-projects Home Service System Appointment Booking booking.php cross site scripting

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-27 · updated 2026-10-26
Weakness: CWE-79

Description

A security vulnerability has been detected in code-projects Home Service System 1.0. The impacted element is an unknown function of the file /booking.php of the component Appointment Booking. The manipulation of the argument fname/lname leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.

Affected products

code-projects Home Service System: 1.0

References

https://code-projects.org/
https://github.com/Xmyronn/home-service-system-unauth-stored-xss-admin-takeover-code-project.org-.git
https://vuldb.com/submit/800121
https://vuldb.com/vuln/359664
https://vuldb.com/vuln/359664/cti

Get alerted when CVE-2026-7089 or the next vulnerability affects your stack