CVE-2023-48016

Restaurant Table Booking System V1.0 is vulnerable to SQL Injection in rtbs/admin/index.php via the username parameter...

Sql injection

Restaurant Table Booking System V1.0 is vulnerable to SQL Injection in rtbs/admin/index.php via the username parameter...

Restaurant Table Booking System Security Vulnerability

PHPGurukul Restaurant Table Booking System is a restaurant table booking system. A security vulnerability exists in Restaurant Table Booking System due to cross-site scripting in the username parameter of rtbs/admin/index.php...

CVE-2023-48016

Restaurant Table Booking System V1.0 is reported to be vulnerable to SQL Injection in rtbs/admin/index.php via the username parameter. Root cause: unsanitized input leading to SQLi. Impact per CVE/Metrics: high severity (CVSS 3.1 base score 7.5) with confidentiality impact but no integrity/availa...

Hotel Booking Lite < 4.8.5 - Unauthenticated Arbitrary File Download & Deletion

Description The plugin does not validate file paths provided via user input, as well as does not have proper CSRF and authorisation checks, allowing unauthenticated users to download and delete arbitrary files on the server To download /etc/passwd: curl...

CVE-2023-48016

Restaurant Table Booking System V1.0 is vulnerable to SQL Injection in rtbs/admin/index.php via the username parameter...

PT-2023-30665 · Unknown · Restaurant Table Booking System

Name of the Vulnerable Software and Affected Versions: Restaurant Table Booking System version 1.0 Description: The issue is related to SQL Injection in the rtbs/admin/index.php file via the username parameter. This allows for potential exploitation of the system. Recommendations: For Restaurant...

CVE-2023-36507 WordPress BookingPress Plugin <= 1.0.64 is vulnerable to Sensitive Data Exposure

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Repute Infosystems BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin.This issue affects BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin: from n/a through 1.0.6...

CVE-2023-36507

Summary (CVE-2023-36507) : Affected software is the BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin for WordPress. The issue is an unauthenticated information disclosure in BookingPress versions up to and including 1.0.64, caused by exposure of sensitive server inf...

WordPress 10to8 Online Appointment Booking System Plugin <= 1.0.9 is vulnerable to Cross Site Scripting (XSS)

Software 10to8 Online Appointment Booking System Type Plugin Vulnerable versions = 1.0.9 Fixed in 1.1.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-49173 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 11459360bec5 Credits Ngô Thiên An...

CVE-2023-5209

The WordPress Online Booking and Scheduling Plugin WordPress plugin before 22.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example ...

CVE-2023-5209

The WordPress Online Booking and Scheduling Plugin WordPress plugin before 22.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example ...

CVE-2023-4252

The EventPrime WordPress plugin through 3.2.9 specifies the price of a booking in the client request, allowing an attacker to purchase bookings without payment...

Design/Logic Flaw

The EventPrime WordPress plugin through 3.2.9 specifies the price of a booking in the client request, allowing an attacker to purchase bookings without payment...

Cross site scripting

The WordPress Online Booking and Scheduling Plugin WordPress plugin before 22.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example ...

CVE-2023-5209

CVE-2023-5209 affects WordPress Online Booking and Scheduling Plugin (Bookly) prior to 22.5. The vulnerability arises from insufficient sanitization/escaping of certain settings, allowing Stored XSS by high-privilege users (e.g., admins) even when unfiltered_html is disallowed (e.g., multisite). ...

CVE-2023-4252 EventPrime <= 3.2.9 - Booking Pricing Bypass

The EventPrime WordPress plugin through 3.2.9 specifies the price of a booking in the client request, allowing an attacker to purchase bookings without payment...

CVE-2023-4252

The CVE concerns the EventPrime WordPress plugin (up to version 3.2.9). The root cause is that the client request can specify the price of a booking, enabling an attacker to complete a booking without paying. Public docs corroborate the existence of a payment bypass vulnerability and provide a Po...

CVE-2023-5209 Bookly < 22.5 - Admin+ Stored XSS

The WordPress Online Booking and Scheduling Plugin WordPress plugin before 22.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example ...

WordPress plugin WordPress Online Booking and Scheduling Plugin Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blog sites on PHP and MySQL servers.WordPress plugin is an...