9990 matches found
CVE-2022-1407: Cross-Site Request Forgery (CSRF)
The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not have CSRF check in place when adding a tracking campaign, and does not escape the campaign fields when outputting them In attributes. As a result, attackers could make a logged in admin add tracking campaign with XSS...
CVE-2022-1408: Improper Neutralization of Input During Web Page Generation
The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not escape various settings before outputting them in attributes, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...
PT-2022-13864
Name of the Vulnerable Software and Affected Versions VikBooking Hotel Booking Engine & PMS WordPress plugin versions prior to 1.5.8 Description The issue allows attackers to make a logged-in admin add a tracking campaign with XSS payloads via a CSRF attack, as there is no CSRF check in place whe...
Online Sports Complex Booking System SQL注入漏洞（CNVD-2022-58669）
Online Sports Complex Booking System is an online stadium booking system by Carlo Montero, a personal developer. page=facilities/managefacility&id= lacks validation of external input SQL statements, which can be exploited to execute illegal SQL commands to steal sensitive database data...
Online Sports Complex Booking System SQL注入漏洞（CNVD-2022-58668）
Online Sports Complex Booking System is an online stadium booking system by Carlo Montero, a personal developer. page=clients/manageclient&id= lacks validation of external input SQL statements, which could be exploited to execute illegal SQL commands to steal sensitive database data...
Online Sports Complex Booking System SQL注入漏洞（CNVD-2022-58670）
Online Sports Complex Booking System is an online stadium booking system by Carlo Montero, a personal developer. page=user/manageuser&id= lacks validation of external input SQL statements, which can be exploited to execute illegal SQL commands to steal sensitive database data...
CVE-2022-1409: Unrestricted Upload of File with Dangerous Type
The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not properly validate images, allowing high privilege users such as administrators to upload PHP files disguised as images and containing malicious PHP code...
WordPress plugin VikBooking Hotel Booking Engine & PMS 代码问题漏洞
WordPress is a suite of blogging platforms developed using the PHP language. WordPress plugin is an application plug-in. PHP is a scripting language that executes on the server side. WordPress VikBooking Hotel Booking Engine...
Online Sports Complex Booking System SQL注入漏洞（CNVD-2022-58671）
Online Sports Complex Booking System is an online stadium booking system by Carlo Montero, a personal developer. Online Sports Complex Booking System version 1.0 is vulnerable to a SQL injection vulnerability that originates in /scbs/admin/ bookings/viewbooking.php?id=, an attacker can execute...
Online Sports Complex Booking System SQL注入漏洞（CNVD-2022-58672）
Online Sports Complex Booking System is an online stadium booking system by Carlo Montero, a personal developer. Online Sports Complex Booking System version 1.0 is vulnerable to a SQL injection vulnerability that originates in /scbs/admin/ categories/managecategory.php?id=, an attacker can execu...
Simple Bus Ticket Booking System SQL Injection Vulnerability
Simple Bus Ticket Booking System, a bus ticket booking system, is vulnerable to a SQL injection vulnerability in version 1.0 of Simple Bus Ticket Booking System, which originates in the username and password parameters in /assets/partials/handleLogin.php. and password parameters in...
CVE-2022-29986
Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via \scbs\classes\Master.php?f=deletefacility...
CVE-2022-29990
Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via /scbs/admin/categories/viewcategory.php?id=...
CVE-2022-29988
Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via \scbs\classes\Master.php?f=delete...
CVE-2022-29989
Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via \scbs\classes\Master.php?f=deletebooking...
CVE-2022-29992
Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via /scbs/admin/categories/managecategory.php?id=...
CVE-2022-29995
Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via /scbs/admin/?page=clients/manageclient&id=...
CVE-2022-29987
Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via /scbs/admin/?page=user/manageuser&id=...