Vulnerability · Published Jun 5, 2026 · Assigned by VulDB

CVE-2026-11338SourceCodester Ship Ferry Ticket Reservation System manage_user cross site scripting

Low 2.4

In plain English

A low-severity cross-site scripting in Ship Ferry Ticket Reservation System from SourceCodester. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).

Severity (CVSS 3.1)2.4Low

Exploit odds (30 days)0.3%top 82.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A security vulnerability has been detected in SourceCodester Ship Ferry Ticket Reservation System 1.0. Impacted is an unknown function of the file /admin/?page=user/manage_user. The manipulation of the argument Username leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.

Affected products (as reported)

Vendor	Product	Versions
SourceCodester	Ship Ferry Ticket Reservation System	1.0

Weakness: CWE-79, CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R

References

VDB-368880 | SourceCodester Ship Ferry Ticket Reservation System manage_user cross site scripting vdb-entry, technical-description
VDB-368880 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-11338 | CVE Analysis and Report third-party-advisory
Submit #832571 | SourceCodester Ship/Ferry Ticket Reservation System 1.0 Cross Site Scripting third-party-advisory
https://medium.com/@hemantrajbhati5555/stored-cross-site-scripting-stored-xss-in-username-field-leads-to-arbitrary-javascript-execution-cd377841da30 broken-link, exploit
https://www.sourcecodester.com/ product