CVE-2026-7089 Details

A stored cross-site scripting vulnerability has been identified in Code-Projects Home Service System version 1.0. The issue resides in the Appointment Booking component, specifically within the booking.php file. The vulnerability is triggered by manipulating the fname and lname parameters, allowing remote, unauthenticated attackers to inject malicious JavaScript. This injected script is executed in the context of the administrator's browser when they access the Manage Booking section in admin.php. The exploitation of this vulnerability could lead to the theft of the admin session cookie, allowing the attacker to take over the admin account and perform administrative actions.

It is recommended to sanitize user inputs by applying htmlspecialchars() with ENT_QUOTES before storing or rendering them. Additionally, implementing a Content Security Policy (CSP) header and validating all form inputs on the server side can help mitigate this vulnerability.