Online Hotel Booking System Pro 1.3 Cross Site Scripting Vulnerability

Online Hotel Booking System Pro version 1.3 suffers from a cross site scripting vulnerability. Exploit Title: Online Hotel Booking System Pro 1.3 - Cross Site Scripting Google Dork: N/A Date: 2017/08/12 Exploit Author: ShanoWeb Author Mail : MrdotNet2NetatGmaildotcom Vendor Homepage:...

Bus Booking Script Cross-Site Scripting Vulnerability

Bus Booking Script is an online bus booking management system based on PHP and MySQL. A cross-site scripting vulnerability exists in Bus Booking Script. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML...

Joomla JB Tour Booking 2.2.2 SQL Injection Vulnerability

Joomla JB Tour Booking extension 2.2.2 suffers from a remote SQL injection vulnerability. Title: Joomla JB Tour Booking 2.2.2 SQL Injection Credit: Bilal KARDADOU Vendor: https://joombooking.com URL: https://extensions.joomla.org/extensions/extension/vertical-markets/booking-a-reservations/jb-tou...

Joomla JB Tour Booking 2.2.2 SQL Injection

Title: Joomla JB Tour Booking 2.2.2 SQL Injection Credit: Bilal KARDADOU Vendor: https://joombooking.com URL: https://extensions.joomla.org/extensions/extension/vertical-markets/booking-a-reservations/jb-tour/ Product: 'Joomla JB Tour Booking component version 2.2.2' Developer: Joombooking Last...

Joomla JB Bus 2.3.0 SQL Injection Vulnerability

Exploit for php platform in category web applications Title: Joomla JB Bus 2.3.0 SQL Injection Credit: Bilal KARDADOU Vendor: https://joombooking.com URL: https://extensions.joomla.org/extensions/extension/vertical-markets/booking-a-reservations/jbtransport/ Product: 'Joomla JB Bus component...

Joomla JB Bus 2.3.0 SQL Injection

Title: Joomla JB Bus 2.3.0 SQL Injection Credit: Bilal KARDADOU Vendor: https://joombooking.com URL: https://extensions.joomla.org/extensions/extension/vertical-markets/booking-a-reservations/jbtransport/ Product: 'Joomla JB Bus component version 2.3.0' Developer: Joombooking Last updated: Apr 19...

Cross site request forgery (csrf)

Bus Booking Script has CSRF via admin/newmaster.php...

CVE-2017-17828

Bus Booking Script has XSS via the results.php datepicker parameter or the admin/newmaster.php spemail parameter...

Design/Logic Flaw

Bus Booking Script has XSS via the results.php datepicker parameter or the admin/newmaster.php spemail parameter...

Sql injection

Bus Booking Script has SQL Injection via the admin/viewseatseller.php spid parameter or the admin/viewmember.php memid parameter...

CVE-2017-17828

Bus Booking Script has XSS via the results.php datepicker parameter or the admin/newmaster.php spemail parameter...

CVE-2017-17829

Bus Booking Script has SQL Injection via the admin/viewseatseller.php spid parameter or the admin/viewmember.php memid parameter...

CVE-2017-17830

Bus Booking Script has CSRF via admin/newmaster.php...

CVE-2017-17830

Bus Booking Script has CSRF via admin/newmaster.php...

CVE-2017-17829

The CVE-2017-17829 entry corresponds to a SQL injection vulnerability in Bus Booking Script (PHP/MySQL). Affected components are the admin/view_seatseller.php sp_id parameter and the admin/view_member.php memid parameter, as described across multiple sources (NVD, CNVD, RH Red Hat, CVE lists). Th...

CVE-2017-17830

CVE-2017-17830 affects Bus Booking Script, with a cross-site request forgery (CSRF) vulnerability found in admin/new_master.php. The connected documents consistently describe CSRF via this endpoint as the issue; no explicit product versions, root-cause detail beyond CSRF, or remediation steps are...

CVE-2017-17830

Bus Booking Script has CSRF via admin/newmaster.php...

CVE-2017-17828

Bus Booking Script has XSS via the results.php datepicker parameter or the admin/newmaster.php spemail parameter...

CVE-2017-17829

Bus Booking Script has SQL Injection via the admin/viewseatseller.php spid parameter or the admin/viewmember.php memid parameter...

CVE-2017-17828

CVE-2017-17828 affects Bus Booking Script (PHP/MySQL). The vulnerability is a Cross-Site Scripting (XSS) flaw exploitable via the results.php datepicker parameter or the admin/new_master.php spemail parameter. The connected sources confirm the same XSS description across multiple feeds; no vendor...