CVE-2019-5972

Cross-site scripting vulnerability in Online Lesson Booking 0.8.6 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Online Lesson Booking 0.8.6 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors...

Cross site scripting

Cross-site scripting vulnerability in Online Lesson Booking 0.8.6 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2019-5972

CVE-2019-5972 affects the WordPress plugin Online Lesson Booking (versions 0.8.6 and earlier). It is a stored cross-site scripting (CWE-79) vulnerability that could allow remote attackers to inject arbitrary script/HTML, potentially executing in the browser of users with administrative privileges...

CVE-2019-5973

CVE-2019-5973 is a CSRF vulnerability in the WordPress Plugin “Online Lesson Booking” that affects version 0.8.6 and earlier. The flaw allows remote attackers to hijack an administrator’s authenticated session via unspecified vectors, potentially enabling unintended actions while the administrato...

CVE-2019-5973

Cross-site request forgery CSRF vulnerability in Online Lesson Booking 0.8.6 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors...

CVE-2019-5972

Cross-site scripting vulnerability in Online Lesson Booking 0.8.6 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

PT-2019-17907 · Unknown · Online Lesson Booking

Name of the Vulnerable Software and Affected Versions: Online Lesson Booking versions 0.8.6 and earlier Description: A cross-site request forgery issue allows remote attackers to hijack the authentication of administrators. Recommendations: For versions 0.8.6 and earlier, update to a version late...

Appointment Booking Calendar < 1.3.19 - Unauthenticated Stored XSS

Lack of authorisation check in the cpabcappointmentssaveedition function can lead to stored XSS via the editionarea parameter when cfwppedit is set to 'js' or 'css' /wp-admin/admin-ajax.php" method="POST" "/ /wp-admin/admin-ajax.php" method="POST" "/ The payload will be triggered in all pages wit...

Appointment Booking Calendar < 1.3.19 - Unauthenticated Stored XSS

Lack of authorisation check in the cpabcappointmentssaveedition function can lead to stored XSS via the editionarea parameter when cfwppedit is set to 'js' or 'css' PoC The payload will be triggered in all pages with a booking form...

CVE-2018-17842

SQL injection exists in Scriptzee Hotel Booking Engine 1.0 via the hotels hroomtype parameter...

CVE-2018-17842

SQL injection exists in Scriptzee Hotel Booking Engine 1.0 via the hotels hroomtype parameter...

Sql injection

SQL injection exists in Scriptzee Hotel Booking Engine 1.0 via the hotels hroomtype parameter...

CVE-2018-17842

SQL injection exists in Scriptzee Hotel Booking Engine 1.0 via the hotels hroomtype parameter...

CVE-2018-17842

CVE-2018-17842 affects Scriptzee Hotel Booking Engine 1.0, with a SQL injection vulnerability exposed via the hotels h_room_type parameter. The vulnerability allows potentially unauthorized access to data and manipulation of the backend database. According to NVD, the CVSS scores are CVSSv3.1: 9....

Why we shouldn’t use sequential booking references

I travel a lot with work. In the last 6 months there have only be 2 weeks where I haven’t been to Heathrow airport. Heathrow isn’t the easiest journey by public transport for me as the PTP HQ is in a field in north Bucks. Hence, I usually end driving to the airport. I’ve been to Heathrow twice th...

WordPress Travel Booking Theme <= 2.7 - Reflected & Stored Cross-Site Scripting XSS vulnerability

Reflected & Stored Cross-Site Scripting XSS vulnerability found by QUIXSS in WordPress Traveler - Travel Booking Theme versions = 2.7.1. Solution 11 June 2019 - we were unable to find a fixed version...

Multiple vulnerabilities in WordPress Plugin "Online Lesson Booking"

Overview WordPress Plugin "Online Lesson Booking" provided by SUKIMALAB.COM contains multiple vulnerabilities listed below. Stored cross-site scripting vulnerability CWE-79 - CVE-2019-5972 Cross-site request forgery vulnerability CWE-352 - CVE-2019-5973 Natsumi Matsuoka of Cryptography...

Online Lesson Booking <= 0.8.6 - CSRF & XSS

The Online Lesson Booking WordPress plugin was affected by a CSRF & XSS security vulnerability...

WordPress Online Lesson Booking Plugin Cross-Site Request Forgery Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers.Online Lesson Booking Plugin is an online booking plugin used in it. A cross-site request forgery vulnerability exists in...