WordPress Plugin Car Park Booking - SQL Injection

Exploit Title: Wordpress Plugin Car Park Booking - SQL Injection Date: 2017-10-17 Exploit Author: 8bitsec Vendor Homepage: https://codecanyon.net/item/car-park-booking-wordpress-plugin/20284035 Software Link: https://codecanyon.net/item/car-park-booking-wordpress-plugin/20284035 Version: 13 Octob...

tickets.airbaltic.com XSS vulnerability

Vulnerable URL: https://tickets.airbaltic.com/ru/book/avail Details: Description| Value ---|--- Patched:| Verification in progress Latest check for patch:| 14.01.2018 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status:| No...

yanair.ua XSS vulnerability

Vulnerable URL: http://www.yanair.ua/booking.htmlBookingSecondPagePlace:false&2017-10-11&2017-10-%3Csvg%20onload=alert/XSSPOSED/%3E&3&&1=1,2=0,3=0& Details: Description| Value ---|--- Patched:| No Latest check for patch:| 09.01.2018 Vulnerability type:| XSS Vulnerability status:| Publicly disclos...

city-oberland.ch XSS vulnerability

Vulnerable URL: https://www.city-oberland.ch/booking/modules/hotelextended/calendar.php?arrive=1〈=en=22%3E%3Cimg%20src=x%20onerror=alert/OPENBUGBOUNTY/%3E30=07=city-oberland=Y-m-d=arrive= Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicl...

Professional Service Booking Software 1.0 SQL Injection

Exploit Title: Professional Service Booking Software 1.0 - SQL Injection Dork: N/A Date: 09.09.2017 Vendor Homepage: http://scriptzee.com/ Software Link: http://scriptzee.com/best-softwares/professional-service-booking-engine Demo: http://professionalservice.scriptzee.com/ Version: 1.0 Category:...

Professional Service Booking 1.0 - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Professional Service Booking Software 1.0 - SQL Injection Dork: N/A Date: 09.09.2017 Vendor Homepage: http://scriptzee.com/ Software Link: http://scriptzee.com/best-softwares/professional-service-booking-engine Demo:...

Professional Service Booking 1.0 - SQL Injection

Professional Service Booking 1.0 - SQL Injection Exploit Title: Professional Service Booking Software 1.0 - SQL Injection Dork: N/A Date: 09.09.2017 Vendor Homepage: http://scriptzee.com/ Software Link: http://scriptzee.com/best-softwares/professional-service-booking-engine Demo:...

Zomato: IDOR to cancel any table booking and leak sensitive information such as email,mobile number,uuid

Hacker is able to cancel the other user's table booking, The same request leaked the private information of the user email & mobile no...

PHP Appointment Booking Script - Authentication Bypass Vulnerability

Exploit for php platform in category web applications ======================================================== Description : an attacker is able to inject malicious sql query to bypass the login page and login as admin Proof of Concept : - http://localhost/appointment/adminlogin.php set username...

Car or Cab Booking Script - Authentication Bypass Vulnerability

Exploit for php platform in category web applications...

legolandholidays.de XSS vulnerability

Vulnerable URL: https://www.legolandholidays.de/booking/package/results.html?==0=2000=%22%27,;%3C/script%3E%3Cscript%3Econfirm%27OPENBUGBOUNTY%27%3C/script%3E=29.08.2017=5=03.09.2017=0=100=%5B%7B%22numberOfAdults%22%3A2%2C%22childAges%22%3A%5B%5D%7D%5D=LLDP2 Details: Description| Value ---|---...

PHP Appointment Booking Script - Authentication Bypass

PHP Appointment Booking Script - Authentication Bypass ======================================================== Description : an attacker is able to inject malicious sql query to bypass the login page and login as admin Proof of Concept : - http://localhost/appointment/adminlogin.php set username...

PHP Appointment Booking Script - Authentication Bypass

======================================================== Description : an attacker is able to inject malicious sql query to bypass the login page and login as admin Proof of Concept : - http://localhost/appointment/adminlogin.php set username and password to admin' or 1=1 -- -...

Meeting and Hotel Booking Provider's Data Found in Public Amazon S3 Bucket

Leaks of personal and business information from unsecured Amazon S3 buckets are piling up. The latest belongs to Groupize, a Boston-area business that sells tools to manage small group meetings as well as a booking engine that handles hotel room-block reservations. Researchers at Kromtech Securit...

hotelolimpia.net XSS vulnerability

Vulnerable URL: http://www.hotelolimpia.net/booking.html?bform%5Bcheckin%5D=%22%3E%3C/iframe%3E%3Cimg%20src=x%20onerror=prompt/OPENBUGBOUNTY/%3E%5Bcheckout%5D=18-08-2017%5BnumRooms%5D=1%5BreqRooms%5D%5B1%5D%5Badults%5D=2%5BreqRooms%5D%5B1%5D%5Bchild%5D=0 Details: Description| Value ---|---...

magicalshuttle.co.uk XSS vulnerability

Vulnerable URL: http://magicalshuttle.co.uk/booking Details: Description| Value ---|--- Patched:| Yes, at 27.11.2017 Latest check for patch:| 27.11.2017 21:36 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 820390 VIP website status:| No Check magicalshuttle.co....

suu.edu XSS vulnerability

Vulnerable URL: https://www.suu.edu/mc/experts/book-expert.php?expert=1"...

city-oberland.ch XSS vulnerability

Vulnerable URL: https://www.city-oberland.ch/booking/modules/hotelextended/calendar.php?arrive=1〈=en=2017=06=city-oberland=Y-m-d=arrive=1"...

haltonhonda.com XSS vulnerability

Vulnerable URL: http://www.haltonhonda.com/new/book-a-test-drive/?vehicleid=8293418"' /Style=position:fixed;top:0;left:0;font-size:999px; /Onmouseenter=confirmOPENBUGBOUNTY // Details: Description| Value ---|--- Patched:| No Latest check for patch:| 31.07.2017 Vulnerability type:| XSS Vulnerabili...

CVE-2017-2168

Cross-site scripting vulnerability in WP Booking System Free version prior to version 1.4 and WP Booking System Premium version prior to version 3.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...