7920 matches found
CVE-2022-0920
The CVE-2022-0920 entry concerns WordPress plugins “Salon booking system Free and Pro” prior to version 7.6.3. Connected sources consistently describe an access control error in several endpoints that could let authenticated users view all bookings and other customers’ data. The vulnerability ste...
CVE-2022-0919
The CVE-2022-0919 vulnerability affects the WordPress plugin “Salon booking system Free and pro” (pre-7.6.3). The flaw is an authentication/authorization bypass in booking searches: unauthenticated users can search other people’s bookings and view sensitive data (full name, email, phone) associat...
CVE-2022-0919 Salon booking system < 7.6.3 - Unauthenticated Sensitive Data Disclosure
The Salon booking system Free and pro WordPress plugins before 7.6.3 do not have proper authorisation when searching bookings, allowing any unauthenticated users to search other's booking, as well as retrieve sensitive information about the bookings, such as the full name, email and phone number ...
WordPress plugin 安全漏洞
WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. The platform supports personal blogging sites on PHP and MySQL servers. WordPress Salon booking system Free and pro is vulnerable to an information disclosure vulnerability that could be exploite...
WordPress plugin advanced-booking-calendar 跨站脚本漏洞
WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. WordPress plugin is a WordPress open source application plugin. WordPress advanced-booking-calendar plugin versions pri...
WordPress plugin 安全漏洞
WordPress is a set of blogging platforms developed by the Wordpress Foundation using the PHP language. The platform supports personal blogging sites on PHP and MySQL servers. WordPress Salon booking system Free and Pro has an access control error vulnerability that stems from improper authorizati...
Nextcloud Calendar -- SMTP Command Injection
reports: SMTP Command Injection in Appointment Emails via Newlines: as newlines and special characters are not sanitized in the email value in the JSON request, a malicious attacker can inject newlines to break out of the RCPT TO: SMTP command and begin injecting arbitrary SMTP commands...
WordPress plugin Advanced Booking Calendar SQL注入漏洞
WordPress is a set of blogging platforms developed by the Wordpress Foundation using the PHP language. WordPress plugin is an application plugin for WordPress. WordPress Advanced Booking Calendar before plugin version 1.7.1 is vulnerable to a SQL injection vulnerability that stems from The plugin...
CVE-2022-28000
Car Rental System v1.0 was discovered to contain a SQL injection vulnerability at /CarRental/booking.php via the id parameter...
CVE-2022-28000
Car Rental System v1.0 was discovered to contain a SQL injection vulnerability at /CarRental/booking.php via the id parameter...
CVE-2022-28000
Car Rental System v1.0 was discovered to contain a SQL injection vulnerability at /CarRental/booking.php via the id parameter...
Car Rental System SQL注入漏洞
Car Rental System is a car rental system by individual developer AMEY THAKUR in India. car Rental System v1.0 is vulnerable to SQL injection, which originates from the lack of SQL data filtering for the id parameter in /CarRental/booking.php, and can be exploited by attackers to execute illegal S...
WordPress Booking Package信息泄露漏洞
WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. The platform supports the hosting of personal blog sites on PHP and MySQL servers. WordPress Booking Package is vulnerable to an information disclosure vulnerability that could be exploited by...
Online Banquet Booking System 1.0 Cross Site Request Forgery Vulnerability
Exploit Title: Online Banquet Booking System - 'change admin credentials' Cross-Site Request Forgery CSRF Date: 04/04/2022 Exploit Author: Saud Alenazi Vendor Homepage: https://phpgurukul.com Software Link: https://phpgurukul.com/online-banquet-booking-system-using-php-and-mysql/ Version: 1.0...
CVE-2022-28115
Online Sports Complex Booking v1.0 was discovered to contain a SQL injection vulnerability via the id parameter...
CVE-2022-28115
Online Sports Complex Booking v1.0 was discovered to contain a SQL injection vulnerability via the id parameter...
CVE-2022-28115
Online Sports Complex Booking v1.0 was discovered to contain a SQL injection vulnerability via the id parameter...
Sql injection
Online Sports Complex Booking v1.0 was discovered to contain a SQL injection vulnerability via the id parameter...
CVE-2022-28115
The CVE-2022-28115 entry applies to Online Sports Complex Booking v1.0. Affected component: the application’s handling of the id parameter. Vulnerability: SQL injection via id parameter, enabling potentially unauthorized access or data manipulation. Root cause stated in the description is a SQL i...