130 matches found
PT-2023-29899 · WordPress · Booking Calendar
Name of the Vulnerable Software and Affected Versions: Booking Calendar WordPress plugin versions prior to 9.7.3.1 Description: The issue allows unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators due to the plugin's failure to sanitize and escape some of i...
Booking Calendar < 9.7.3.1 - Unauthenticated Stored XSS
Description The plugin does not sanitize and escape some of its booking from data, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators As an unauthenticated user, submit a booking form such form can be added via the Booking Calendar Block on a...
CVE-2023-23971
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in CodePeople WP Time Slots Booking Form plugin = 1.1.81 versions...
CVE-2023-23971
Summary: CVE-2023-23971 affects the CodePeople WP Time Slots Booking Form WordPress plugin (versions ≤ 1.1.81). The root cause is an authenticated stored XSS due to insufficient sanitization/escaping in plugin settings, enabling an admin+ user to inject scripts that could be executed by other use...
WordPress plugin WP Time Slots Booking Form 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerability...
WordPress WP Time Slots Booking Form Plugin <= 1.1.76 is vulnerable to Broken Access Control
Software WP Time Slots Booking Form Type Plugin Vulnerable versions = 1.1.76 Fixed in 1.1.77 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2022-41790 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 5e92c19f0383 Credits István Márton...
WordPress WP Time Slots Booking Form Plugin <= 1.1.82 is vulnerable to Broken Access Control
Software WP Time Slots Booking Form Type Plugin Vulnerable versions = 1.1.82 Fixed in 1.1.83 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-23895 Patch priority Low CVSS severity Low 4.7 Developer Claim ownership PSID 9da0396d6743 Credits yuyudhn Required...
Cross site scripting
A vulnerability classified as problematic was found in SourceCodester Wedding Hall Booking System. Affected by this vulnerability is an unknown functionality of the file /whbs/?page=mybookings of the component Booking Form. The manipulation of the argument Remarks leads to cross site scripting. T...
CVE-2022-2690
The CVE-2022-2690 issue affects SourceCodester Wedding Hall Booking System, specifically the /whbs/?page=my_bookings Booking Form. The known vulnerability is cross-site scripting triggered by manipulating the Remarks parameter in that function, with remote exploitation possible. Public disclosure...
CVE-2022-2690 SourceCodester Wedding Hall Booking System Booking Form cross site scripting
A vulnerability classified as problematic was found in SourceCodester Wedding Hall Booking System. Affected by this vulnerability is an unknown functionality of the file /whbs/?page=mybookings of the component Booking Form. The manipulation of the argument Remarks leads to cross site scripting. T...
CVE-2022-27862
Arbitrary File Upload leading to RCE in E4J s.r.l. VikBooking Hotel Booking Engine & PMS plugin = 1.5.3 on WordPress allows attackers to upload and execute dangerous file types e.g. PHP shell via the signature upload on the booking form...
CVE-2022-27862
Arbitrary File Upload leading to RCE in E4J s.r.l. VikBooking Hotel Booking Engine & PMS plugin = 1.5.3 on WordPress allows attackers to upload and execute dangerous file types e.g. PHP shell via the signature upload on the booking form...
WordPress WP Time Slots Booking Form Plugin Cross-Site Scripting Vulnerability
WordPress is a set of blogging platforms developed using the PHP language by the Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress WP Time Slots Booking Form Plugin versions prior to...
Cross site scripting
The WP Time Slots Booking Form WordPress plugin before 1.1.63 does not sanitise and escape Calendar names, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...
CVE-2022-0389
CVE-2022-0389 affects the WP Time Slots Booking Form WordPress plugin (versions before 1.1.63). The issue arises because the plugin does not sanitise/escape calendar names, enabling stored Cross-Site Scripting (XSS) by high-privilege users, even when unfiltered_html is disallowed. Public reports ...
WP Time Slots Booking Form < 1.1.63 - Admin+ Stored Cross-Site Scripting
The plugin does not sanitise and escape Calendar names, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. PoC Create a new calendar with the following Name: The XSS will be triggered when editing or publishing the calendar...
Car Rental System <= 1.3 - Unauthenticated Stored Cross-Site Scripting (XSS)
An unauthenticated user can inject malicious JavaScript via the booking form, specifically in the new user details. The XSS payload is then executed when an authenticated administrator user views the booking on the booking-list and cust-lookup pages. PoC Inject XSS via most fields in the booking...
Online Hotel Booking System Pro <= 1.1 - Unauthenticated Stored Cross-Site Scripting (XSS)
An unauthenticated user can inject malicious JavaScript via the booking form, specifically in the new user details.. The XSS payload is then executed when an authenticated administrator user views the booking on the Customer-booking page. PoC Inject XSS via most fields in the booking form, which...
