Advanced Booking Calendar < 1.6.8 - Authenticated Reflected Cross-Site Scripting (XSS)

The plugin does not sanitise the license error message when output in the settings page, leading to an authenticated reflected Cross-Site Scripting issue https://plugins.trac.wordpress.org/browser/advanced-booking-calendar/tags/1.6.7/backend/settings.phpL550...

Advanced Booking Calendar < 1.6.7 - Authenticated Reflected Cross-Site Scripting (XSS)

The plugin did not sanitise the calId GET parameter in the "Seasons & Calendars" page before outputing it in an A tag, leading to a reflected XSS issue PoC Payloads: - Original reporter:...

WordPress wp-hotel-booking plugin deserialization vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. wp-hotel-booking is a plugin for WordPress. A security vulnerability exists in wp-hotel-booking plugin 1.10.2...

Bad Bot Traffic on Healthcare Websites Rises 372% As Vaccines Become Available Globally

Nations around the world are racing to acquire COVID-19 vaccines and assemble digital infrastructure and web applications to enable appointment booking. As they do this, Imperva Research Labs has monitored a staggering 372% increase in bad bot traffic on healthcare websites globally since Septemb...

CVE-2020-29047

The wp-hotel-booking plugin through 1.10.2 for WordPress allows remote attackers to execute arbitrary code because of an unserialize operation on the thimpresshotelbooking1 cookie in load in includes/class-wphb-sessions.php...

CVE-2020-29047

The CVE-2020-29047 entry concerns the WordPress plugin WP Hotel Booking (versions

WordPress 代码问题漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. wp-hotel-booking is a plugin for WordPress. A security vulnerability exists in wp-hotel-booking plugin 1.10.2...

PT-2021-11642 · WordPress · Wp Hotel Booking

Name of the Vulnerable Software and Affected Versions: wp-hotel-booking plugin versions 1.10.2 and earlier Description: The issue allows remote attackers to execute arbitrary code because of an unserialize operation on the thimpress hotel booking 1 cookie in the includes/class-wphb-sessions.php...

WordPress WP Hotel Booking plugin <= 1.10.2 - Unauthenticated Remote Code Execution (RCE) via Arbitrary Object Deserialisation vulnerability

Unauthenticated Remote Code Execution RCE via Arbitrary Object Deserialisation vulnerability discovered by Nick Blundell AppCheck Ltd in WordPress WP Hotel Booking plugin versions = 1.10.2. Solution Update the WordPress WP Hotel Booking plugin to the latest available version at least 1.10.3...

Command Execution Vulnerability in Urve

Urve is a device for booking meeting rooms/guest rooms. A command execution vulnerability exists in Urve. An attacker could exploit this vulnerability to gain server privileges...

Online Hotel Reservation System 1.0 - 'person' time-based SQL Injection

Exploit Title: Online Hotel Reservation System 1.0 - 'person' time-based SQL Injection Exploit Author: Mesut Cetin Date: 2021-01-15 Vendor Homepage: https://www.sourcecodester.com/php/13492/online-hotel-reservation-system-phpmysqli.html Software Link:...

Online Bus Booking System SQL Injection (CVE-2020-25889)

An SQL injection vulnerability exists in Online Bus Booking System Project . Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system...

CVE-2020-25889

Online Bus Booking System Project Using PHP/MySQL version 1.0 has SQL injection via the login page. By placing SQL injection payload on the login page attackers can bypass the authentication and can gain the admin privilege...

Sql injection

Online Bus Booking System Project Using PHP/MySQL version 1.0 has SQL injection via the login page. By placing SQL injection payload on the login page attackers can bypass the authentication and can gain the admin privilege...

CVE-2020-25889

Online Bus Booking System Project Using PHP/MySQL version 1.0 has SQL injection via the login page. By placing SQL injection payload on the login page attackers can bypass the authentication and can gain the admin privilege...

CVE-2020-25889

CVE-2020-25889 affects the Online Bus Booking System Project Using PHP/MySQL v1.0. The login page is vulnerable to SQL injection due to improper input handling, allowing an attacker to bypass authentication and potentially gain admin privileges. Multiple sources (NVD, Red Hat advisory, PRION, CVE...

WP Hotel Booking <= 1.10.3 - Unauthenticated PHP Object Injection

The plugin unserialised the value in the thimpresshotelbooking1 cookie without sanitisation, which could lead to an unauthenticated PHP Object Injection. If the plugin is installed on WP 5.5.2, then there is a suitable gadget chain to obtain RCE, otherwise, another gadget chain will have to be us...

SourceCodester Online Bus Booking System SQL Injection Vulnerability

SourceCodester Online Bus Booking System is an online bus booking system by an individual developer. The system helps bus companies manage the booking and ticketing process. A SQL injection vulnerability exists in Online Bus Booking System Project Using PHP/MySQL version 1.0, which can be exploit...

Online Doctor Appointment Booking System SQL Injection Vulnerability

Online Doctor Appointment Booking System is a web-based online appointment booking system from PHP Scripts Mall Php Scripts Mall, India. Online Doctor Appointment Booking System suffers from a SQL injection vulnerability that originates from a SQL injection vulnerability in the getuser.php...

Proxymedia Car Rental Management System SQL Injection Vulnerability

Car Rental Management System is a PHP/MySQLi based car rental management system. SQL injection vulnerability exists in Car Rental Management System 1.0. An attacker can exploit this vulnerability to conduct SQL injection attacks via the id parameter in viewcar.php or the carid parameter in...