CVE-2018-20647: Improper Limitation of a Pathname to a Restricted Directory

PHP Scripts Mall Car Rental Script 2.0.8 has directory traversal via a direct request for a listing of an image directory such as an images/ directory...

CVE-2018-20648: Cross-Site Request Forgery (CSRF)

PHP Scripts Mall Car Rental Script 2.0.8 has Cross-Site Request Forgery CSRF via accountedit.php...

CVE-2018-15182: Improper Neutralization of Input During Web Page Generation

PHP Scripts Mall Car Rental Script 2.0.8 has XSS via the FirstName and LastName fields...

CVE-2018-6904: Improper Neutralization of Input During Web Page Generation

PHP Scripts Mall Car Rental Script 2.0.8 has XSS via the User Name field in an Edit Profile action...

CVE-2017-17905: Cross-Site Request Forgery (CSRF)

PHP Scripts Mall Car Rental Script has CSRF via admin/sitesettings.php...

CVE-2017-17907: Improper Neutralization of Input During Web Page Generation

PHP Scripts Mall Car Rental Script has XSS via the admin/areaedit.php carid parameter or the admin/sitesettings.php websitename parameter...

CVE-2017-17906: Improper Neutralization of Special Elements used in an SQL Command

PHP Scripts Mall Car Rental Script has SQL Injection via the admin/carlistedit.php carid parameter...