7933 matches found
WP Booking System – Booking Calendar < 2.0.15 - Authenticated Reflected Cross-Site Scripting (XSS)
The plugin was affected by a reflected xss in wp-booking-system on the wpbs-calendars admin page. PoC http://127.0.0.1:8001/wp-admin/admin.php?page=wpbs-calendars=%22+style%3Danimation-name%3Arotation+onanimationstart%3Dalert%281%29+x%3D or...
WordPress WP Booking System plugin <= 2.0.14 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability
Authenticated Reflected Cross-Site Scripting XSS vulnerability discovered by Krzysztof Zając in WordPress WP Booking System plugin versions = 2.0.14. Solution Update the WordPress WP Booking System plugin to the latest available version at least 2.0.15...
WP Booking System – Booking Calendar < 2.0.15 - Authenticated Reflected Cross-Site Scripting (XSS)
The plugin was affected by a reflected xss in wp-booking-system on the wpbs-calendars admin page. http://127.0.0.1:8001/wp-admin/admin.php?page=wpbs-calendars&s=%22+style%3Danimation-name%3Arotation+onanimationstart%3Dalert%281%29+x%3D or...
WordPress Online Booking and Scheduling Plugin Cross-Site Scripting Vulnerability
WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. WordPress Online Booking and Scheduling plugin has a cross-site scripting vulnerability in versions prior to 20.3.1,...
CVE-2021-24930
The WordPress Online Booking and Scheduling Plugin WordPress plugin before 20.3.1 does not escape the Staff Full Name field before outputting it back in a page, which could lead to a Stored Cross-Site Scripting issue...
CVE-2021-24930
The WordPress Online Booking and Scheduling Plugin WordPress plugin before 20.3.1 does not escape the Staff Full Name field before outputting it back in a page, which could lead to a Stored Cross-Site Scripting issue...
Cross site scripting
The WordPress Online Booking and Scheduling Plugin WordPress plugin before 20.3.1 does not escape the Staff Full Name field before outputting it back in a page, which could lead to a Stored Cross-Site Scripting issue...
CVE-2021-24930
The WordPress Online Booking and Scheduling Plugin WordPress plugin before 20.3.1 does not escape the Staff Full Name field before outputting it back in a page, which could lead to a Stored Cross-Site Scripting issue...
CVE-2021-24930
The CVE-2021-24930 relates to the WordPress Bookly/Booking plugin (Bookly) for WordPress, affected in versions up to 20.3.0. The root cause is failure to escape the Staff Full Name field before output, causing a Stored Cross-Site Scripting (XSS) vulnerability. The NVD data indicates a CVSSv3.1 ba...
CVE-2021-24930 Bookly < 20.3.1 - Staff Member Stored Cross-Site Scripting
The WordPress Online Booking and Scheduling Plugin WordPress plugin before 20.3.1 does not escape the Staff Full Name field before outputting it back in a page, which could lead to a Stored Cross-Site Scripting issue...
Booking Calendar < 8.9.2 - Reflected Cross-Site Scripting
The plugin does not sanitise and escape the bookingtype parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting https://example.com/wp-admin/admin.php?page=wpbc&bookingtype=%22%3E%3Cimg+src+onerror%3Dalert%28/XSS/%29%3E%3Cscript%3E%2F%2A...
WordPress Booking Calendar plugin <= 8.9.1 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting XSS vulnerability discovered by Krzysztof Zając in WordPress Booking Calendar plugin versions = 8.9.1. Solution Update the WordPress Booking Calendar plugin to the latest available version at least 8.9.2...
PT-2021-16372 · WordPress · Wordpress Online Booking/Scheduling Plugin
Name of the Vulnerable Software and Affected Versions: The WordPress Online Booking and Scheduling Plugin version 20.3.0 and earlier Description: The issue is related to a Stored Cross-Site Scripting problem. It occurs because the Staff Full Name field is not properly escaped before being outputt...
WordPress 插件跨站脚本漏洞
WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. WordPress Online Booking and Scheduling plugin has a cross-site scripting vulnerability in versions prior to 20.3.1,...
Booking Calendar < 8.9.2 - Reflected Cross-Site Scripting
The plugin does not sanitise and escape the bookingtype parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting PoC https://example.com/wp-admin/admin.php?page=wpbctype=%22%3E%3Cimg+src+onerror%3Dalert%28/XSS/%29%3E%3Cscript%3E%2F%2A...
Tripexpress path traversal vulnerability
Tripexpress is an open source bus tour travel booking management web application by Shpetim Islami, an Austrian individual developer. tripexpress suffers from a path traversal vulnerability, which originates from the assignment of $SERVERargv assigned to src, the lack of effective filtering and...
Laundry Booking Management System 1.0 Remote Code Execution
Exploit Title: Laundry Booking Management System 1.0 - Remote Code Execution RCE Date: 29/11/2021 Exploit Author: Pablo Santiago Vendor Homepage: https://www.sourcecodester.com/php/14400/laundry-booking-management-system-php-source-code.html Software Link:...
Tripexpress 路径遍历漏洞
Tripexpress is an open source bus tour travel booking management web application by Shpetim Islami, an Austrian individual developer. tripexpress suffers from a path traversal vulnerability, which originates from the assignment of $SERVERargv assigned to src, the lack of effective filtering and...
CVE-2021-20840
Cross-site scripting vulnerability in Booking Package - Appointment Booking Calendar System versions prior to 1.5.11 allows a remote attacker to inject an arbitrary script via unspecified vectors...