CVE-2025-7800 cgpandey hotelmis HTTP GET Request admin.php cross site scripting
An attacker can inject malicious scripts via the Search parameter in admin.php, potentially compromising user sessions or executing code.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-7800?
CVE-2025-7800 is a medium-severity cross-site scripting vulnerability in cgpandey hotelmis, published on 18 Jul 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
A vulnerability classified as problematic was found in cgpandey hotelmis up to c572198e6c4780fccc63b1d3e8f3f72f825fc94e. This vulnerability affects unknown code of the file admin.php of the component HTTP GET Request Handler. The manipulation of the argument Search leads to cross site scripting. The attack can be initiated remotely. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available.
Which versions are affected by CVE-2025-7800?
How do I fix CVE-2025-7800?
No fix has been published for CVE-2025-7800 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-7800 being exploited?
There is no known exploitation of CVE-2025-7800 in the wild and no public exploit code.
Sources
Also known as GHSA-488q-cf9g-9qqc.