WordPress Booking Calendar Contact Form 1.0.23 Shortcode SQL Injection

Exploit Title: Wordpress booking calendar contact form =v1.0.23 - Unauthenticated blind SQL injection Date: 2016-02-08 Google Dork: Index of /wp-content/plugins/booking-calendar-contact-form Exploit Author: Joaquin Ramirez Martinez i0 SEC-LABORATORY Vendor Homepage: http://wordpress.dwbooster.com...

WordPress Booking Calendar Contact Form 1.0.23 CSRF / XSS

Exploit Title: Wordpress booking calendar contact form =v1.0.23 - Privilege escalation / stored XSS vulnerabilities Date: 2016-02-08 Google Dork: Index of /wp-content/plugins/booking-calendar-contact-form Exploit Author: Joaquin Ramirez Martinez i0 SEC-LABORATORY Vendor Homepage:...

WordPress Booking Calendar Contact Form 1.0.23 Plugin - Multiple Vulnerabilities

Exploit for php platform in category web applications Exploit Title: Wordpress booking calendar contact form =v1.0.23 - Unauthenticated blind SQL injection Date: 2016-02-08 Google Dork: Index of /wp-content/plugins/booking-calendar-contact-form Exploit Author: Joaquin Ramirez Martinez i0...

WordPress Booking Calendar Contact Form Plugin 1.0.23 - Multiple Vulnerabilities

This plugin is prone to multiple vulnerabilities, such as unauthenticated blind SQL injection, privilege escalation and stored XSS vulnerabilities. Solution Upgrade the plugin...

WordPress Plugin Booking Calendar Contact Form 1.0.23 - Multiple Vulnerabilities

WordPress Plugin Booking Calendar Contact Form 1.0.23 - Multiple Vulnerabilities Exploit Title: Wordpress booking calendar contact form =v1.0.23 - Unauthenticated blind SQL injection Date: 2016-02-08 Google Dork: Index of /wp-content/plugins/booking-calendar-contact-form Exploit Author: Joaquin...

WordPress Booking Calendar Contact Form 1.0.23 Blind SQL Injection

Exploit Title: Wordpress booking calendar contact form =v1.0.23 - Unauthenticated blind SQL injection Date: 2016-02-08 Google Dork: Index of /wp-content/plugins/booking-calendar-contact-form Exploit Author: Joaquin Ramirez Martinez i0 SEC-LABORATORY Vendor Homepage: http://wordpress.dwbooster.com...

WordPress Plugin Booking Calendar Contact Form 1.0.23 - Multiple Vulnerabilities

Exploit Title: Wordpress booking calendar contact form =v1.0.23 - Unauthenticated blind SQL injection Date: 2016-02-08 Google Dork: Index of /wp-content/plugins/booking-calendar-contact-form Exploit Author: Joaquin Ramirez Martinez i0 SEC-LABORATORY Vendor Homepage: http://wordpress.dwbooster.com...

Zomato: XSS and CSRF in Zomato Contact form

URL affected:-- https://www.zomato.com/contact CSRF Payload:-- Step to Reproduce:---- 1I have tested it after Login and without Login .This CSRF worked with executing XSS due to CSRF in Contact form.It is tested in Latest Firefox browser. 2Just run the above payload and you will find below image...

WordPress Booking Calendar Contact Form 1.1.24 Plugin - Multiple Vulnerabilities

Exploit for php platform in category web applications Exploit Title: WordPress appointment-booking-calendar =1.1.24 - Privilege escalation Managing calendars & Persistent XSS Date: 2016-01-28 Google Dork: Index of /wordpress/wp-content/plugins/appointment-booking-calendar/ Exploit Author: Joaquin...

WordPress Booking Calendar Contact Form Plugin 1.1.24 - Addslashes SQL Injection

SQL injection is executed, when the action "cpabcappointmentscalendarupdate" is called. Because of this vulnerability, an attacker can compromise all the web server. Solution Update the plugin...

WordPress Booking Calendar Contact Form Plugin 1.1.24 - Multiple Vulnerabilities

This plugin is prone to persistent XSS vulnerabilities that appear in the administration page. Solution Upgrade the plugin...

WordPress Plugin Booking Calendar Contact Form 1.1.24 - Multiple Vulnerabilities

WordPress Plugin Booking Calendar Contact Form 1.1.24 - Multiple Vulnerabilities Exploit Title: WordPress appointment-booking-calendar =1.1.24 - Privilege escalation Managing calendars & Persistent XSS Date: 2016-01-28 Google Dork: Index of...

WordPress Plugin Booking Calendar Contact Form 1.1.24 - Multiple Vulnerabilities

Exploit Title: WordPress appointment-booking-calendar =1.1.24 - Privilege escalation Managing calendars & Persistent XSS Date: 2016-01-28 Google Dork: Index of /wordpress/wp-content/plugins/appointment-booking-calendar/ Exploit Author: Joaquin Ramirez Martinez i0 security-lab Software Link:...

WordPress Booking Calendar Contact Form 1.1.23 Plugin - Shortcode SQL Injection

Exploit for php platform in category web applications Exploit Title: WordPress appointment-booking-calendar =1.1.23 - Shortcode SQL injection Date: 2016-01-24 Google Dork: Index of /wordpress/wp-content/plugins/appointment-booking-calendar/ Exploit Author: Joaquin Ramirez Martinez i0 security-lab...

WordPress Booking Calendar Contact Form Plugin 1.1.23 - Shortcode SQL Injection

This vulnerability can be exploited by adding crafted shortcodes on a page or post. Because of it, an attacker can compromise all web server. Solution Upgrade the plugin...

WordPress Booking Calendar Contact Form Plugin 1.1.23 - Unauthenticated SQL Injection

This WordPress Booking Calendar Contact Form plugin's "action=cpabcappointmentscheckIPNverification" parameter is prone to an unauthenticated SQL injection. This vulnerability allows an attacker to modify data, compromise the access and application or exploit hidden vulnerabilities in the...

Local File Disclosure

SECURITY Fix CVE-2017-5223, local file disclosure vulnerability if content passed to msgHTML is sourced from unfiltered user input. Reported by Yongxiang Li of Asiasecurity. The fix for this means that calls to msgHTML without a $basedir will not import images with relative URLs, and relative...

WordPress Contact Form 3.81 Cross Site Scripting

Plugin Details Plugin Name : Contact Form Effected Version : 3.81 and most probably lower version's if any Vulnerability : A3-Cross-Site Scripting XSS Identified by : Madhu Akula Technical Details Minimum Level of Access Required : Unauthenticated PoC - Proof of Concept :...

WordPress Contact Form To DB 1.4.0 Cross Site Scripting

Plugin Name : Contact Form To DB Effected Version : 1.4.0 and most probably lower version's if any Vulnerability : A3-Cross-Site Scripting XSS Identified by : Madhu Akula Technical Details Minimum Level of Access Required : Administrator PoC - Proof of Concept : The following field put the payloa...

stolaf.edu XSS vulnerability

Open Bug Bounty ID: OBB-114770 Description| Value ---|--- Affected Website:| stolaf.edu Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat Sheet...