Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2021-39473 — Proof-of-concept for stored XSS in HotelManager v1.2, demonstrating remote exploitation via comment/contact fields without bypass. | Kitploit
Tools/GitHubGitHub/brunoteixeira1996/cve-2021-39473
Vulnerability AnalysisExploitationWeb Application ExploitationWeb SecurityPenetration Testing
GitHubbrunoteixeira1996/cve-2021-39473

CVE-2021-39473

Proof-of-concept for stored XSS in HotelManager v1.2, demonstrating remote exploitation via comment/contact fields without bypass.

View Repository
13 years agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2021-39473

Affected Product Code Base

HotelManager - v1.2

Affected Component

Kernel.php; Middleware

Attack Type

Remote

Attack Vectors

To exploit this vulnerability the user needs to create "rooms" or "guests" or "reservations" or "users" and in the "comment" or "contact" field can execute a xss payload without even doing any bypass.

This is a stored XSS since I was able to store payloads on endpoints (rooms, guests, ...) and trigger them using different accounts.

Link to the issue

https://github.com/Saibamen/HotelManager/issues/49 https://github.com/Saibamen/HotelManager/issues/49

Download Tool