WordPress Appointment Booking Calendar Plugin <= 1.1.7 - SQL Injection

This vulnerability allows an attacker to execute arbitrary SQL commands via unspecified vectors that are related to updating the username. Solution Update the plugin...

Google Adsense & Hotel Booking <= 1.0.5 - Open Proxy

Plugin is still affected and has been closed. The code in ./plugin/google-adsense-and-hotel-booking/proxy.php allows an arbitrary user to proxy POST requests though the host site. This may allow attackers to hide attacks, or DoS a site if the POST request is pointed back at itself causing a loop...

WordPress Google Adsense and Hotel Booking Plugin <= 1.05 - Open Redirection

The vulnerability is in the ./plugin/google-adsense-and-hotel-booking/proxy.php. It allows an arbitrary user to proxy POST requests though the host site. This may allow attackers to hide attacks. Solution Update the plugin...

Google Adsense & Hotel Booking <= 1.0.5 - Open Proxy

Plugin is still affected and has been closed. The code in ./plugin/google-adsense-and-hotel-booking/proxy.php allows an arbitrary user to proxy POST requests though the host site. This may allow attackers to hide attacks, or DoS a site if the POST request is pointed back at itself causing a loop...

Threat Outbreak Alert RuleID17198: Email Messages Distributing Malicious Software on August 10, 2015

Medium Alert ID: 40389 First Published: 2015 August 10 16:14 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID17198 may contain the following files: Name |...

neworleansonline.com XSS vulnerability

Vulnerable URL: http://www.neworleansonline.com/book/rooms/lodging.php?lodgingType=1=%22%3E%3Csvg%2Fonload%3Dalert%28%2Fxssposed.org%2F%29%3E=1=&Submit2;=Search+for+Lodging Details: Description| Value ---|--- Patched:| No Latest check for patch:| 25.07.2017 Vulnerability type:| XSS Vulnerability...

WordPress Booking System Plugin <= 2.0 - Blind SQL Injection

Because of this vulnerability, remote authenticated users can execute arbitrary SQL commands via "language" parameter. Solution Update the plugin...

Pinpoint Booking System <= 2.0 - Authenticated Blind SQL Injection

The Pinpoint Booking System – 1 WordPress Booking Plugin WordPress plugin was affected by an Authenticated Blind SQL Injection security vulnerability...

Hotels.com Phishing Scam Duping Travelers

An undisclosed number of travelers who use Hotels.com may have been victims of a phishing scheme. The company said some customers were recently tricked into disclosing their names, phone numbers, email addresses and travel bookings. An individual was reportedly able to convince customers that the...

SQL injection vulnerability in the id parameter in Ticketmaster ERP web-based ticketing system/Sales/meb_his.aspx?id=.

Ltd. Ticketmaster ERP management system is a special ticket management system for air ticket agents, integrating online booking management, telephone recording screen, corporate travel management, order management in the same industry, membership management, points management, SMS sending, staff...

WordPress Booking Calendar Contact Form Plugin 1.0.2 /dex_bccf.php SQL注入漏洞

/dexbccf.phpfunction dexbccfcaculateprice$startday, $enddate, $calendar, $defaultprice ... //$calendar is not sanitized in sql query $codes = $wpdb-getresults 'SELECT FROM '.$wpdb-prefix.DEXBCCFSEASONPRICESTABLENAMENOPREFIX.' WHERE calid='.$calendar; $mode =...

WordPress Booking Calendar Contact Form 1.0.2 - Multiple Vulnerabilities

Exploit for php platform in category web applications Exploit Title: WordPress Booking Calendar Contact Form 1.0.2Multiple vulnerabilities Date: 2015-05-01 Google Dork: Index of /wordpress/wp-content/plugins/booking-calendar-contact-form/ Exploit Author: Joaquin Ramirez Martinez i0akiN...

Booking Calendar Contact Form <= 1.0.2 - Multiple Authenticated Vulnerabilities

The Booking Calendar Contact Form WordPress plugin was affected by a Multiple Authenticated Vulnerabilities security vulnerability...

WordPress Booking Calendar Contact Form Plugin 1.0.2 - Multiple vulnerabilities

Booking Calendar Contact Form plugin is prone to multiple vulnerabilities: 1. Authenticated SQL injection in "get" parameter allows an attacker to escalate editor privileges. 2. Filter bypass & Authenticated SQL injection in "id" parameter via...

WordPress Booking Calendar Contact Form 1.0.2 XSS / SQL Injection

Exploit Title: WordPress Booking Calendar Contact Form 1.0.2Multiple vulnerabilities Date: 2015-05-01 Google Dork: Index of /wordpress/wp-content/plugins/booking-calendar-contact-form/ Exploit Author: Joaquin Ramirez Martinez i0akiN SEC-LABORATORY Software Link:...

WordPress Plugin Booking Calendar Contact Form 1.0.2 - Multiple Vulnerabilities

Exploit Title: WordPress Booking Calendar Contact Form 1.0.2Multiple vulnerabilities Date: 2015-05-01 Google Dork: Index of /wordpress/wp-content/plugins/booking-calendar-contact-form/ Exploit Author: Joaquin Ramirez Martinez i0akiN SEC-LABORATORY Software Link:...

CVE-2014-10015

SQL injection vulnerability in load-calendar.php in PHPJabbers Event Booking Calendar 2.0 allows remote attackers to execute arbitrary SQL commands via the cid parameter...

CVE-2014-10014

Multiple cross-site request forgery CSRF vulnerabilities in PHPJabbers Event Booking Calendar 2.0 allow remote attackers to hijack the authentication of administrators for requests that 1 change the username and password of the administrator via an update action to the AdminOptions controller or...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in PHPJabbers Event Booking Calendar 2.0 allow remote attackers to hijack the authentication of administrators for requests that 1 change the username and password of the administrator via an update action to the AdminOptions controller or...

CVE-2014-10015

CVE-2014-10015 is a SQL injection vulnerability in the PHPJabbers Event Booking Calendar 2.0, specifically in load-calendar.php where the vulnerable parameter is cid . The issue allows remote attackers to execute arbitrary SQL commands, as described across multiple sources (NVD entry and corrobor...