CVE-2022-4035 Appointment Hour Booking <= 1.3.72 - Unauthenticated iFrame Injection via Appointment Form

The Appointment Hour Booking plugin for WordPress is vulnerable to iFrame Injection via the ‘email’ or general field parameters in versions up to, and including, 1.3.72 due to insufficient input sanitization and output escaping that makes injecting iFrame tags possible. This makes it possible for...

CVE-2022-4034

The WordPress Appointment Hour Booking Plugin is affected by a CSV Injection vulnerability in versions up to and including 1.3.72. Unauthenticated attackers can embed untrusted input into booking content, which may be exported as a CSV file and opened on a vulnerable system, potentially resulting...

CVE-2022-4034 Appointment Hour Booking <= 1.3.72 - CSV Injection

The Appointment Hour Booking Plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.3.72. This makes it possible for unauthenticated attackers to embed untrusted input into content during booking creation that may be exported as a CSV file when a site's...

WordPress plugin Appointment Hour Booking 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A CSV injection vulnerabili...

PT-2022-25353 · WordPress · Appointment Hour Booking Plugin

Name of the Vulnerable Software and Affected Versions: Appointment Hour Booking Plugin for WordPress versions up to, and including, 1.3.72 Description: The issue allows unauthenticated attackers to embed untrusted input into content during booking creation, which may be exported as a CSV file whe...

PT-2022-25355 · WordPress · Appointment Hour Booking

Name of the Vulnerable Software and Affected Versions: Appointment Hour Booking plugin for WordPress versions up to, and including, 1.3.72 Description: The issue arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject iFrame tags via the email...

Appointment Hour Booking < 1.3.73 - Unauthenticated iFrame Injection

The plugin does not sanitise and escape the email and general field parameters, which could allow unauthenticated users to perform iFrame injection attack PoC As an unauthenticated user, submit a booking and put an iFrame payload in the email/general field parameter The iFrame will be executed wh...

PT-2022-25362 · WordPress · Appointment Hour Booking

Name of the Vulnerable Software and Affected Versions: Appointment Hour Booking plugin for WordPress versions up to, and including, 1.3.72 Description: The issue is related to a CAPTCHA bypass due to the use of an insufficiently strong hashing algorithm on the CAPTCHA secret. This secret is also...

WordPress plugin Appointment Hour Booking 加密问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A weak algorithmic...

Appointment Hour Booking < 1.3.73 - Unauthenticated iFrame Injection

The plugin does not sanitise and escape the email and general field parameters, which could allow unauthenticated users to perform iFrame injection attack As an unauthenticated user, submit a booking and put an iFrame payload in the email/general field parameter The iFrame will be executed when a...

WordPress plugin Appointment Hour Booking 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An iFrame injection...

WordPress Booking Calendar Plugin SQL Injection (CVE-2018-20556)

A command execution vulnerability exists in WordPress Plugin Booking Calendar . Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

asith-eranga ISIC Arbitrary File Upload Vulnerability

ISIC is a web backend for asith-eranga individual developers. An arbitrary file upload vulnerability exists in asith-eranga ISIC tour booking 2018.02.13 and earlier versions. The vulnerability stems from a lack of valid validation of uploaded files. An attacker can exploit the vulnerability to...

Unspecified vulnerability in WordPress Appointment Booking Calendar plugin

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2022-30529

File upload vulnerability in asith-eranga ISIC tour booking through version published on Feb 13th 2018, allows attackers to upload arbitrary files via /system/application/libs/js/tinymce/plugins/filemanager/dialog.php and /system/application/libs/js/tinymce/plugins/filemanager/upload.php...

Unrestricted file upload

File upload vulnerability in asith-eranga ISIC tour booking through version published on Feb 13th 2018, allows attackers to upload arbitrary files via /system/application/libs/js/tinymce/plugins/filemanager/dialog.php and /system/application/libs/js/tinymce/plugins/filemanager/upload.php...

CVE-2022-30529

CVE-2022-30529 corresponds to a file-upload vulnerability in the asith-eranga ISIC tour booking software (versions up to 2018-02-13). The issue allows uploading arbitrary files via two TinyMCE file manager endpoints: /system/application/libs/js/tinymce/plugins/filemanager/dialog.php and /system/a...

PT-2022-20160 · Tinymce +1 · Tinymce +1

Name of the Vulnerable Software and Affected Versions: asith-eranga ISIC tour booking versions through the version published on Feb 13th 2018 Description: The issue allows attackers to upload arbitrary files via "/system/application/libs/js/tinymce/plugins/filemanager/dialog.php" and...

CVE-2022-30529

File upload vulnerability in asith-eranga ISIC tour booking through version published on Feb 13th 2018, allows attackers to upload arbitrary files via /system/application/libs/js/tinymce/plugins/filemanager/dialog.php and /system/application/libs/js/tinymce/plugins/filemanager/upload.php...

CVE-2022-30529

File upload vulnerability in asith-eranga ISIC tour booking through version published on Feb 13th 2018, allows attackers to upload arbitrary files via /system/application/libs/js/tinymce/plugins/filemanager/dialog.php and /system/application/libs/js/tinymce/plugins/filemanager/upload.php...