8702 matches found
PT-2023-30972 · Unknown · Time Slots Booking Calendar
Name of the Vulnerable Software and Affected Versions: Time Slots Booking Calendar version 4.0 Description: The issue concerns Multiple Stored Cross-Site Scripting XSS problems. These issues can be exploited via several parameters, including name, plugin sms api key, plugin sms country code,...
PT-2023-30975 · Unknown · Availability Booking Calendar
Name of the Vulnerable Software and Affected Versions: Availability Booking Calendar version 5.0 Description: A lack of rate limiting in pjActionAJaxSend allows attackers to cause resource exhaustion. Recommendations: For Availability Booking Calendar version 5.0, consider implementing rate...
PT-2023-30976 · Unknown · Time Slots Booking Calendar
Name of the Vulnerable Software and Affected Versions: Time Slots Booking Calendar version 4.0 Description: A lack of rate limiting in the pjActionAJaxSend function allows attackers to cause resource exhaustion. Recommendations: For Time Slots Booking Calendar version 4.0, consider implementing...
PT-2023-30732 · Unknown · Availability Booking Calendar
Name of the Vulnerable Software and Affected Versions: Availability Booking Calendar version 5.0 Description: The issue allows CSV injection via the unique ID field in the Reservations list component. Recommendations: For Availability Booking Calendar version 5.0, consider restricting access to t...
PT-2023-30969 · Unknown · Availability Booking Calendar
Name of the Vulnerable Software and Affected Versions: Availability Booking Calendar version 5.0 Description: The issue concerns Multiple HTML Injection problems. These issues can be exploited via the SMS API Key or the Default Country Code. Recommendations: For Availability Booking Calendar...
PHPJabbers Time Slots Booking Calendar 4.0 CSV Injection
Exploit Title: PHPJabbers Time Slots Booking Calendar v4.0 - CSV Injection Date: 13/11/2023 Exploit Author: BugsBD Limited Discover by: Rahad Chowdhury Vendor Homepage: https://www.phpjabbers.com/ Software Link: https://www.phpjabbers.com/time-slots-booking-calendar/ Version: v4.0 Tested on:...
PHPJabbers Availability Booking Calendar 5.0 HTML Injection
Exploit Title: PHPJabbers Availability Booking Calendar v5.0 - HTML Injection Date: 13/11/2023 Exploit Author: BugsBD Limited Discover by: Rahad Chowdhury Vendor Homepage: https://www.phpjabbers.com/ Software Link: https://www.phpjabbers.com/availability-booking-calendar/sectionDemo Version: v5.0...
PHPJabbers Time Slots Booking Calendar 4.0 HTML Injection
Exploit Title: PHPJabbers Time Slots Booking Calendar v4.0 - HTML Injection Date: 13/11/2023 Exploit Author: BugsBD Limited Discover by: Rahad Chowdhury Vendor Homepage: https://www.phpjabbers.com/ Software Link: https://www.phpjabbers.com/time-slots-booking-calendar/ Version: v4.0 Tested on:...
WordPress Spiffy Calendar Plugin <= 4.9.5 is vulnerable to Cross Site Scripting (XSS)
Software Spiffy Calendar Type Plugin Vulnerable versions = 4.9.5 Fixed in 4.9.6 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-49745 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 28c8f76cf91e Credits resecured.io Required privilege...
PHPJabbers Time Slots Booking Calendar 4.0 Missing Rate Limiting
Exploit Title: PHPJabbers Time Slots Booking Calendar v4.0 - No Rate Limit in Email Date: 19/11/2023 Exploit Author: BugsBD Limited Discover by: Rahad Chowdhury Vendor Homepage: https://www.phpjabbers.com/ Software Link: https://www.phpjabbers.com/time-slots-booking-calendar/ Version: v4.0 Tested...
PHPJabbers Time Slots Booking Calendar 4.0 Cross Site Scripting
Exploit Title: PHPJabbers Time Slots Booking Calendar v4.0 - Multiple Stored XSS Date: 13/11/2023 Exploit Author: BugsBD Limited Discover by: Rahad Chowdhury Vendor Homepage: https://www.phpjabbers.com/ Software Link: https://www.phpjabbers.com/time-slots-booking-calendar/ Version: v4.0 Tested on...
PHPJabbers Availability Booking Calendar 5.0 Missing Rate Limiting
Exploit Title: PHPJabbers Availability Booking Calendar v5.0 - No Rate Limit in Email Date: 19/11/2023 Exploit Author: BugsBD Limited Discover by: Rahad Chowdhury Vendor Homepage: https://www.phpjabbers.com/ Software Link: https://www.phpjabbers.com/availability-booking-calendar/sectionDemo...
CVE-2023-6360
The 'My Calendar' WordPress Plugin, version 3.4.22 is affected by an unauthenticated SQL injection vulnerability in the 'from' and 'to' parameters in the '/my-calendar/v1/events' rest route...
CVE-2023-36507
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Repute Infosystems BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin.This issue affects BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin: from n/a through 1.0.6...
Sql injection
The 'My Calendar' WordPress Plugin, version 3.4.22 is affected by an unauthenticated SQL injection vulnerability in the 'from' and 'to' parameters in the '/my-calendar/v1/events' rest route...
CVE-2023-36507 WordPress BookingPress Plugin <= 1.0.64 is vulnerable to Sensitive Data Exposure
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Repute Infosystems BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin.This issue affects BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin: from n/a through 1.0.6...
CVE-2023-36507
Summary (CVE-2023-36507) : Affected software is the BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin for WordPress. The issue is an unauthenticated information disclosure in BookingPress versions up to and including 1.0.64, caused by exposure of sensitive server inf...
CVE-2023-6360
The 'My Calendar' WordPress Plugin, version 3.4.22 is affected by an unauthenticated SQL injection vulnerability in the 'from' and 'to' parameters in the '/my-calendar/v1/events' rest route...
CVE-2023-6360
The CVE-2023-6360 entry refers to the WordPress My Calendar plugin, affected versions before 3.4.22, with an unauthenticated SQL injection in the from and to parameters of the /my-calendar/v1/events REST route. The vulnerability can enable arbitrary SQL queries against the database and is categor...
