CVE-2025-63949

Medium · 6.1

CVSS

6.1

EPSS

0.3%

Published

Dec 18, 2025

CISA due date

—

The record

A Reflected Cross-Site Scripting (XSS) vulnerability in yohanawi Hotel Management System (commit 87e004a) allows a remote attacker to execute arbitrary web script via the 'error' parameter in pages/room.php.

Affected packages

Ecosystem	Package	Introduced	Fixed