7852 matches found
CVE-2024-57429
A cross-site request forgery CSRF vulnerability in the pjActionUpdate function of PHPJabbers Cinema Booking System v2.0 allows remote attackers to escalate privileges by tricking an authenticated admin into submitting an unauthorized request...
PHPJabbers Cinema Booking System 安全漏洞
PHPJabbers Cinema Booking System is a theater booking system from PHPJabbers. A security vulnerability exists in PHPJabbers Cinema Booking System version v2.0, which stems from a cross-site request forgery vulnerability contained in the pjActionUpdate function...
CVE-2024-57427
CVE-2024-57427 affects PHPJabbers Cinema Booking System version 2.0.0. The vulnerability is a reflected XSS in multiple endpoints that improperly handle user input, enabling attackers to craft links or requests to execute scripts in a victim’s browser. Documented impacts include potential theft o...
PT-2025-5832 · Phpjabbers · Phpjabbers Cinema Booking System
Name of the Vulnerable Software and Affected Versions: PHPJabbers Cinema Booking System version 2.0 Description: A stored cross-site scripting XSS issue exists due to unsanitized input in file upload fields event img, seat maps and seat number configurations numbernew X in pjActionCreate. This...
CVE-2024-57429
CVE-2024-57429 is a CSRF vulnerability in PHPJabbers Cinema Booking System v2.0, specifically in the pjActionUpdate function. An attacker can escalate privileges by tricking an authenticated admin into submitting an unauthorized request. Multiple sources in the connected documents corroborate thi...
CVE-2022-1463
The Booking Calendar plugin for WordPress is vulnerable to PHP Object Injection via the bookingflextimeline shortcode in versions up to, and including, 9.1. This could be exploited by subscriber-level users and above to call arbitrary PHP objects on a vulnerable site...
CVE-2022-4035
The Appointment Hour Booking plugin for WordPress is vulnerable to iFrame Injection via the ‘email’ or general field parameters in versions up to, and including, 1.3.72 due to insufficient input sanitization and output escaping that makes injecting iFrame tags possible. This makes it possible for...
CVE-2024-7635
A vulnerability was found in code-projects Simple Ticket Booking 1.0. It has been classified as critical. Affected is an unknown function of the file registerinsert.php of the component Registration Handler. The manipulation of the argument name/email/dob/password/Gender/phone leads to sql...
CVE-2024-7855
The WP Hotel Booking plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the updatereview function in all versions up to, and including, 2.1.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload...
CVE-2024-7636
A vulnerability was found in code-projects Simple Ticket Booking 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file authenticate.php of the component Login. The manipulation of the argument email/password leads to sql injection. The attac...
CVE-2024-3348
A vulnerability classified as critical has been found in SourceCodester Aplaya Beach Resort Online Reservation System 1.0. Affected is an unknown function of the file booking/index.php. The manipulation of the argument logemail/logpword leads to sql injection. It is possible to launch the attack...
CVE-2024-30510
Unrestricted Upload of File with Dangerous Type vulnerability in Salon Booking System Salon booking system.This issue affects Salon booking system: from n/a through 9.5...
CVE-2024-30449
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Booking Activities Team Booking Activities allows Reflected XSS.This issue affects Booking Activities: from n/a through 1.15.19...
CVE-2024-38717
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Booking Ultra Pro allows PHP Local File Inclusion.This issue affects Booking Ultra Pro: from n/a through 1.1.13...
CVE-2024-47360
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in bookingalgorithms BA Book Everything ba-book-everything.This issue affects BA Book Everything: from n/a through = 1.6.20...
CVE-2024-47638
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita allows Reflected XSS.This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: fro...
CVE-2024-32563
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in VikBooking Hotel Booking Engine & PMS allows Reflected XSS.This issue affects VikBooking Hotel Booking Engine & PMS: from n/a through 1.6.7...
CVE-2024-32125
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Booking Algorithms BA Book Everything.This issue affects BA Book Everything: from n/a through 1.6.4...
CVE-2024-32692
Missing Authorization vulnerability in QuanticaLabs Chauffeur Taxi Booking System for WordPress allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Chauffeur Taxi Booking System for WordPress: from n/a through 6.9...