CVE-2025-13802

A stored or reflected cross-site scripting (XSS) vulnerability exists in the jairiidriss RestaurantWebsite project, as identified in commit e7911f12d035e8e2f9a75e7a28b59e4ef5c1d654. The flaw resides in the 'Make a Reservation' component, where the selected_date argument is insufficiently sanitized before being processed, allowing the injection of arbitrary HTML or JavaScript. [1]

An attacker can exploit this issue remotely without requiring authentication, as the reservation form is publicly accessible. The manipulated parameter is rendered back to the user, enabling a standard reflected XSS attack. The exploit details have been publicly disclosed, increasing the likelihood of active attempts. [1]

A successful attack could allow the attacker to execute malicious scripts in the context of the victim's browser session within the application's domain. This could lead to session theft, credential harvesting, or defacement of the booking interface. The vendor was contacted but did not respond, and because the project uses continuous delivery with rolling releases, no fixed version identifier is available. [1]