7904 matches found
Cross site scripting
The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.9 does not escape the current URL before putting it back in a JavaScript context, leading to a Reflected Cross-Site Scripting...
CVE-2022-1528
The CVE-2022-1528 entry affects the VikBooking Hotel Booking Engine & PMS WordPress plugin (before 1.5.9). The vulnerability is a Reflected Cross-Site Scripting caused by not escaping the current URL before embedding it in a JavaScript context, enabling potential script execution. Reported PoCs s...
WordPress plugin VikBooking Hotel Booking Engine & PMS 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress VikBooking Hotel Booking Engine...
CVE-2022-29443
Multiple Authenticated contributor or higher user role Stored Cross-Site Scripting XSS vulnerabilities in Nicdark's Hotel Booking plugin = 3.0 at WordPress...
Hotel Booking <= 3.0 - Contributor+ Stored Cross-Site Scripting
The plugin does not sanitise and escape some parameters, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks...
WordPress Hotel Booking plugin <= 3.0 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities
Multiple Authenticated Stored Cross-Site Scripting XSS vulnerabilities were discovered by Ngo Van Thien Patchstack Alliance in the WordPress Hotel Booking plugin versions = 3.0. Solution Deactivate and delete. This plugin has been closed as of May 6, 2022 and is not available for download. This...
Online Sports Complex Booking System授权问题漏洞
Online Sports Complex Booking System is an online stadium booking system. version 1.0 of the Online Sports Complex Booking System is vulnerable to an authorization issue that could be exploited by attackers to take over a user's account via a specially crafted POST request...
Online Banquet Booking System跨站请求伪造漏洞
Online Banquet Booking System is an online banquet booking system. version 1.0 of Online Banquet Booking System is vulnerable to cross-site request forgery. An attacker could use this vulnerability to change the administrator credentials via a specially crafted POST request...
Online Sports Complex Booking System SQL注入漏洞
Online Sports Complex Booking System is an online stadium booking system. Online Sports Complex Booking System version 1.0 is vulnerable to SQL injection and no details of the vulnerability are available...
Online Sports Complex Booking System SQL注入漏洞（CNVD-2022-58666）
Online Sports Complex Booking System is an online stadium booking system from Carlo Montero's personal developer. Online Sports Complex Booking System v1.0 is vulnerable to SQL injection, which can be exploited by attackers to execute illegal SQL commands to steal sensitive database data...
WordPress Appointment Hour Booking plugin <= 1.3.55 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Bruno Halltari in WordPress Appointment Hour Booking plugin versions = 1.3.55. Solution Update the WordPress Appointment Hour Booking plugin to the latest available version at least 1.3.56...
WordPress Opal Hotel Room Booking plugin跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress Opal Hotel Room Booking plugin 1.2.7 and earlier versions contain a cross-site scripting...
Online Sports Complex Booking System跨站脚本漏洞
Online Sports Complex Booking System is an online stadium booking system from Carlo Montero's personal developer. Online Sports Complex Booking System is vulnerable to a cross-site scripting vulnerability that originates in /scbs/classes/Users. php?f=saveclient lacks a validation filter for...
CVE-2022-28106
Online Sports Complex Booking System v1.0 was discovered to allow attackers to take over user accounts via a crafted POST request...
CVE-2022-28105
Online Sports Complex Booking System v1.0 was discovered to contain a blind SQL injection vulnerability via the id parameter in /scbs/viewfacility.php...
CVE-2022-28106
Online Sports Complex Booking System v1.0 was discovered to allow attackers to take over user accounts via a crafted POST request...
CVE-2022-28992
A Cross-Site Request Forgery CSRF in Online Banquet Booking System v1.0 allows attackers to change admin credentials via a crafted POST request...
CVE-2022-28105
Online Sports Complex Booking System v1.0 was discovered to contain a blind SQL injection vulnerability via the id parameter in /scbs/viewfacility.php...
