Laravel Booking System Booking Core 代码问题漏洞

A code issue vulnerability exists in Laravel Booking System Booking Core, a reservation system, which originates from sandbox.bookingcore.org/user/profile/change- password does not invalidate a session opened in a different browser. No details of the vulnerability are currently available...

CVE-2021-37330: Improper Neutralization of Input During Web Page Generation

Laravel Booking System Booking Core 2.0 is vulnerable to Cross Site Scripting XSS. The Avatar upload in the My Profile section could be exploited to upload a malicious SVG file which contains Javascript. Now if another user/admin views the profile and clicks to view his avatar, an XSS will trigge...

PT-2021-21610

Name of the Vulnerable Software and Affected Versions Laravel Booking System Booking Core version 2.0 Description The issue concerns session management. When a password is changed at the "/user/profile/change-password" API endpoint, it does not invalidate a session opened in a different browser...

WordPress Appointment Hour Booking 插件跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress Plugin is a WordPress open source application plugin . The WordPress Appointment Hour Booking plugin suffers fro...

CVE-2021-37331: Authorization Bypass Through User-Controlled Key

Laravel Booking System Booking Core 2.0 is vulnerable to Incorrect Access Control. On the Verifications page, after uploading an ID Card or Trade License and viewing it, ID Cards and Trade Licenses of other vendors/users can be viewed by changing the URL...

CVE-2021-24673: Improper Neutralization of Input During Web Page Generation

The Appointment Hour Booking WordPress plugin before 1.3.16 does not escape some of the Calendar Form settings, allowing high privilege users to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

PT-2021-21609

Name of the Vulnerable Software and Affected Versions Laravel Booking System Booking Core version 2.0 Description The issue allows unauthorized access to sensitive information. Specifically, on the Verifications page, after uploading an ID Card or Trade License and viewing it, an attacker can vie...

PT-2021-16184

Name of the Vulnerable Software and Affected Versions Appointment Hour Booking WordPress plugin versions prior to 1.3.16 Description The issue allows high privilege users to perform Stored Cross-Site Scripting attacks due to the plugin not escaping some of the Calendar Form settings, even when th...

Booking Core 授权问题漏洞

Booking Core is a software application. A Laravel based booking system designed for travel websites, malls, travel agencies, tour operators, B&Bs, villa rentals, resort rentals, Make Travel websites. An Access Control Error vulnerability exists in Booking Core 2.0, which can be exploited by an...

Booking Core 跨站脚本漏洞

Booking Core is a Laravel-based booking system designed as an application for travel websites, shopping malls, travel agencies, tour operators, bed and breakfasts, villa rentals, resort rentals, and Make Travel websites. A cross-site scripting vulnerability exists in Booking Core. The vulnerabili...

PT-2021-21608

Name of the Vulnerable Software and Affected Versions Laravel Booking System Booking Core version 2.0 Description The issue concerns a Cross Site Scripting XSS problem. Specifically, the Avatar upload feature in the My Profile section can be exploited by uploading a malicious SVG file that contai...

CVE-2021-37333: Insufficient Session Expiration

Laravel Booking System Booking Core 2.0 is vulnerable to Session Management. A password change at sandbox.bookingcore.org/user/profile/change-password does not invalidate a session that is opened in a different browser...

CVE-2020-21012

Sourcecodester Hotel and Lodge Management System 2.0 is vulnerable to unauthenticated SQL injection and can allow remote attackers to execute arbitrary SQL commands via the email parameter to the edit page for Customer, Room, Currency, Room Booking Details, or Tax Details...

CVE-2020-21012

Sourcecodester Hotel and Lodge Management System 2.0 is vulnerable to unauthenticated SQL injection and can allow remote attackers to execute arbitrary SQL commands via the email parameter to the edit page for Customer, Room, Currency, Room Booking Details, or Tax Details...

CVE-2020-21012

Sourcecodester Hotel and Lodge Management System 2.0 is vulnerable to unauthenticated SQL injection and can allow remote attackers to execute arbitrary SQL commands via the email parameter to the edit page for Customer, Room, Currency, Room Booking Details, or Tax Details...

Wappointment < 2.2.5 - Unauthenticated Stored Cross-Site Scripting

The plugin does not sanitise the name parameter when booking an appointment, leading to a Stored Cross-Site Scripting issue which is triggered when an admin view the Calendar. POST /wp-json/wappointment/v1/services/booking HTTP/1.1 Content-Length: 205 Accept: application/json, text/plain, /...

CVE-2021-24726

The WP Simple Booking Calendar WordPress plugin before 2.0.6 did not escape, validate or sanitise the orderby parameter in its Search Calendars action, before using it in a SQL statement, leading to an authenticated SQL injection issue...

CVE-2021-24726

The WP Simple Booking Calendar WordPress plugin before 2.0.6 did not escape, validate or sanitise the orderby parameter in its Search Calendars action, before using it in a SQL statement, leading to an authenticated SQL injection issue...

CVE-2021-24726

The WP Simple Booking Calendar WordPress plugin before 2.0.6 did not escape, validate or sanitise the orderby parameter in its Search Calendars action, before using it in a SQL statement, leading to an authenticated SQL injection issue...

CVE-2021-24726

The CVE relates to the WordPress plugin WP Simple Booking Calendar (versions before 2.0.6). Affected component: the Search Calendars action; root cause is failure to escape/validate/sanitize the orderby parameter, which is used in a SQL statement. This results in an authenticated SQL injection vu...