WordPress Booking System Plugin <= 2.0 - Blind SQL Injection

Because of this vulnerability, remote authenticated users can execute arbitrary SQL commands via "language" parameter. Solution Update the plugin...

Hotels.com Phishing Scam Duping Travelers

An undisclosed number of travelers who use Hotels.com may have been victims of a phishing scheme. The company said some customers were recently tricked into disclosing their names, phone numbers, email addresses and travel bookings. An individual was reportedly able to convince customers that the...

SQL injection vulnerability in the id parameter in Ticketmaster ERP web-based ticketing system/Sales/meb_his.aspx?id=.

Ltd. Ticketmaster ERP management system is a special ticket management system for air ticket agents, integrating online booking management, telephone recording screen, corporate travel management, order management in the same industry, membership management, points management, SMS sending, staff...

WordPress Booking Calendar Contact Form Plugin 1.0.2 /dex_bccf.php SQL注入漏洞

/dexbccf.phpfunction dexbccfcaculateprice$startday, $enddate, $calendar, $defaultprice ... //$calendar is not sanitized in sql query $codes = $wpdb-getresults 'SELECT FROM '.$wpdb-prefix.DEXBCCFSEASONPRICESTABLENAMENOPREFIX.' WHERE calid='.$calendar; $mode =...

WordPress Booking Calendar Contact Form 1.0.2 - Multiple Vulnerabilities

Exploit for php platform in category web applications Exploit Title: WordPress Booking Calendar Contact Form 1.0.2Multiple vulnerabilities Date: 2015-05-01 Google Dork: Index of /wordpress/wp-content/plugins/booking-calendar-contact-form/ Exploit Author: Joaquin Ramirez Martinez i0akiN...

WordPress Booking Calendar Contact Form 1.0.2 XSS / SQL Injection

Exploit Title: WordPress Booking Calendar Contact Form 1.0.2Multiple vulnerabilities Date: 2015-05-01 Google Dork: Index of /wordpress/wp-content/plugins/booking-calendar-contact-form/ Exploit Author: Joaquin Ramirez Martinez i0akiN SEC-LABORATORY Software Link:...

WordPress Booking Calendar Contact Form Plugin 1.0.2 - Multiple vulnerabilities

Booking Calendar Contact Form plugin is prone to multiple vulnerabilities: 1. Authenticated SQL injection in "get" parameter allows an attacker to escalate editor privileges. 2. Filter bypass & Authenticated SQL injection in "id" parameter via...

WordPress Plugin Booking Calendar Contact Form 1.0.2 - Multiple Vulnerabilities

Exploit Title: WordPress Booking Calendar Contact Form 1.0.2Multiple vulnerabilities Date: 2015-05-01 Google Dork: Index of /wordpress/wp-content/plugins/booking-calendar-contact-form/ Exploit Author: Joaquin Ramirez Martinez i0akiN SEC-LABORATORY Software Link:...

Booking Calendar Contact Form <= 1.0.2 - Multiple Authenticated Vulnerabilities

The Booking Calendar Contact Form WordPress plugin was affected by a Multiple Authenticated Vulnerabilities security vulnerability...

CVE-2014-10015

SQL injection vulnerability in load-calendar.php in PHPJabbers Event Booking Calendar 2.0 allows remote attackers to execute arbitrary SQL commands via the cid parameter...

CVE-2014-10014

Multiple cross-site request forgery CSRF vulnerabilities in PHPJabbers Event Booking Calendar 2.0 allow remote attackers to hijack the authentication of administrators for requests that 1 change the username and password of the administrator via an update action to the AdminOptions controller or...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in PHPJabbers Event Booking Calendar 2.0 allow remote attackers to hijack the authentication of administrators for requests that 1 change the username and password of the administrator via an update action to the AdminOptions controller or...

CVE-2014-10014

This CVE concerns PHPJabbers Event Booking Calendar 2.0 with multiple CSRF vulnerabilities. The affected component paths include AdminOptions (update action that can change administrator username/password), AdminEvents (create action with event_title that can lead to XSS), and AdminCategories (cr...

CVE-2014-10015

SQL injection vulnerability in load-calendar.php in PHPJabbers Event Booking Calendar 2.0 allows remote attackers to execute arbitrary SQL commands via the cid parameter...

CVE-2014-10015

CVE-2014-10015 is a SQL injection vulnerability in the PHPJabbers Event Booking Calendar 2.0, specifically in load-calendar.php where the vulnerable parameter is cid . The issue allows remote attackers to execute arbitrary SQL commands, as described across multiple sources (NVD entry and corrobor...

CVE-2014-10014

Multiple cross-site request forgery CSRF vulnerabilities in PHPJabbers Event Booking Calendar 2.0 allow remote attackers to hijack the authentication of administrators for requests that 1 change the username and password of the administrator via an update action to the AdminOptions controller or...

Online Airline Booking System Authentication Bypass

Exploit Title : Online Airline Booking System multiple vulnerabilities Author : WICS Date : 05/1/2016 Software Link : http://sourceforge.net/projects/oabs/ Affected Version: All Overview: The Online Airline Booking System is designed to be an all in one solution for an airline wishing to speed up...

Events Booking, 1.6.7 and lower, (module: Search Events)

Events Booking 1.6.7 =Vulnerability: XSS Cross Site Scripting Extension Update Details This issue only affect the search module Search Events which comes with Events Booking. We released version 1.6.8 to address this issue...

CVE-2014-7647

The BOOKING DISCOUNT aka com.wmygoodhotelscom application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7647

The CVE-2014-7647 entry concerns the BOOKING DISCOUNT (com.wmygoodhotelscom) Android app version 0.1, where SSL server certificate validation is not performed. This allows a man-in-the-middle attacker to spoof servers and potentially obtain sensitive information via a crafted certificate. The doc...