7848 matches found
CVE-2020-27379
Cross Site Request Forgery CSRF vulnerability in Booking Core - Ultimate Booking System Booking Core 1.7.0 . The CSRF token is not being validated when the request is sent as a GET method. This results in an unauthorized change in the user's email ID, which can later be used to reset the password...
CVE-2020-25444
Cross Site Scripting XSS vulnerability in Booking Core - Ultimate Booking System Booking Core 1.7.0 via the 1 "About Yourself” section under the “My Profile” page, " 2 “Hotel Policy” field under the “Hotel Details” page, 3 “Pricing code” and “name” fields under the “Manage Tour” page, and 4 all t...
CVE-2020-25445
The “Subscribe” feature in Ultimate Booking System Booking Core 1.7.0 is vulnerable to CSV formula injection. The input containing the excel formula is not being sanitized by the application. As a result when admin in backend download and open the csv, content of the cells are executed...
CVE-2017-17828
Bus Booking Script has XSS via the results.php datepicker parameter or the admin/newmaster.php spemail parameter...
CVE-2019-5972
Cross-site scripting vulnerability in Online Lesson Booking 0.8.6 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
CVE-2014-10015
SQL injection vulnerability in load-calendar.php in PHPJabbers Event Booking Calendar 2.0 allows remote attackers to execute arbitrary SQL commands via the cid parameter...
CVE-2019-14791
The Appointment Booking Calendar plugin 1.3.18 for WordPress allows XSS via the wp-admin/admin-post.php editionarea parameter...
CVE-2019-13505
The Appointment Hour Booking plugin 1.1.44 for WordPress allows XSS via the E-mail field, as demonstrated by email1...
CVE-2018-5072
Online Ticket Booking has XSS via the admin/sitesettings.php keyword parameter...
CVE-2018-5073
Online Ticket Booking has CSRF via admin/movieedit.php...
CVE-2018-5075
Online Ticket Booking has XSS via the admin/snacksedit.php snacksname parameter...
CVE-2018-5074
Online Ticket Booking has XSS via the admin/manageownerlist.php contact parameter...
CVE-2018-5077
Online Ticket Booking has XSS via the admin/movieedit.php moviename parameter...
CVE-2018-17842
SQL injection exists in Scriptzee Hotel Booking Engine 1.0 via the hotels hroomtype parameter...
CVE-2018-5078
Online Ticket Booking has XSS via the admin/eventlist.php cast parameter...
CVE-2018-20556
SQL injection vulnerability in Booking Calendar plugin 8.4.3 for WordPress allows remote attackers to execute arbitrary SQL commands via the bookingid parameter...
CVE-2019-15774
The nd-booking plugin before 2.5 for WordPress has a nopriv AJAX action that allows modification of the siteurl setting...
CVE-2018-5076
Online Ticket Booking has XSS via the admin/newsedit.php newstitle parameter...