9982 matches found
CVE-2022-1007: Improper Neutralization of Input During Web Page Generation
The Advanced Booking Calendar WordPress plugin before 1.7.1 does not sanitise and escape the room parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue...
CVE-2022-0920: Incorrect Authorization
The Salon booking system Free and Pro WordPress plugins before 7.6.3 do not have proper authorisation in some of its endpoints, which could allow customers to access all bookings and other customer's data...
PT-2022-13526
Name of the Vulnerable Software and Affected Versions The Salon booking system Free and Pro WordPress plugins versions prior to 7.6.3 Description The issue is related to improper authorization in some endpoints of the plugin, which could allow customers to access all bookings and other customers'...
PT-2022-13525
Name of the Vulnerable Software and Affected Versions The Salon booking system Free and pro WordPress plugins versions prior to 7.6.3 Description The issue allows unauthenticated users to search other's bookings and retrieve sensitive information, including full name, email, and phone number of t...
PT-2022-13588
Name of the Vulnerable Software and Affected Versions Advanced Booking Calendar WordPress plugin versions prior to 1.7.1 Description The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the room parameter is not properly sanitised and escaped before being outputted...
PT-2022-13587
Name of the Vulnerable Software and Affected Versions Advanced Booking Calendar WordPress plugin versions prior to 1.7.1 Description The issue is related to the lack of sanitization and escaping of the id parameter when editing Calendars. This could allow high-privilege users, such as admins, to...
WordPress plugin advanced-booking-calendar 跨站脚本漏洞
WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. WordPress plugin is a WordPress open source application plugin. WordPress advanced-booking-calendar plugin versions pri...
WordPress plugin 安全漏洞
WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. The platform supports personal blogging sites on PHP and MySQL servers. WordPress Salon booking system Free and pro is vulnerable to an information disclosure vulnerability that could be exploite...
WordPress plugin 安全漏洞
WordPress is a set of blogging platforms developed by the Wordpress Foundation using the PHP language. The platform supports personal blogging sites on PHP and MySQL servers. WordPress Salon booking system Free and Pro has an access control error vulnerability that stems from improper authorizati...
WordPress plugin Advanced Booking Calendar SQL注入漏洞
WordPress is a set of blogging platforms developed by the Wordpress Foundation using the PHP language. WordPress plugin is an application plugin for WordPress. WordPress Advanced Booking Calendar before plugin version 1.7.1 is vulnerable to a SQL injection vulnerability that stems from The plugin...
CVE-2022-1006: Improper Neutralization of Special Elements used in an SQL Command
The Advanced Booking Calendar WordPress plugin before 1.7.1 does not sanitise and escape the id parameter when editing Calendars, which could allow high privilege users such as admin to perform SQL injection attacks...
CVE-2022-0919: Missing Authorization
The Salon booking system Free and pro WordPress plugins before 7.6.3 do not have proper authorisation when searching bookings, allowing any unauthenticated users to search other's booking, as well as retrieve sensitive information about the bookings, such as the full name, email and phone number ...
Nextcloud Calendar -- SMTP Command Injection
reports: SMTP Command Injection in Appointment Emails via Newlines: as newlines and special characters are not sanitized in the email value in the JSON request, a malicious attacker can inject newlines to break out of the RCPT TO: SMTP command and begin injecting arbitrary SMTP commands...
CVE-2022-28000
Car Rental System v1.0 was discovered to contain a SQL injection vulnerability at /CarRental/booking.php via the id parameter...
CVE-2022-28000
Car Rental System v1.0 was discovered to contain a SQL injection vulnerability at /CarRental/booking.php via the id parameter...
CVE-2022-28000
Car Rental System v1.0 was discovered to contain a SQL injection vulnerability at /CarRental/booking.php via the id parameter...
Car Rental System SQL注入漏洞
Car Rental System is a car rental system by individual developer AMEY THAKUR in India. car Rental System v1.0 is vulnerable to SQL injection, which originates from the lack of SQL data filtering for the id parameter in /CarRental/booking.php, and can be exploited by attackers to execute illegal S...
WordPress Booking Package信息泄露漏洞
WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. The platform supports the hosting of personal blog sites on PHP and MySQL servers. WordPress Booking Package is vulnerable to an information disclosure vulnerability that could be exploited by...
Online Banquet Booking System 1.0 Cross Site Request Forgery Vulnerability
Exploit Title: Online Banquet Booking System - 'change admin credentials' Cross-Site Request Forgery CSRF Date: 04/04/2022 Exploit Author: Saud Alenazi Vendor Homepage: https://phpgurukul.com Software Link: https://phpgurukul.com/online-banquet-booking-system-using-php-and-mysql/ Version: 1.0...