Cross site scripting

The ReDi Restaurant Reservation WordPress plugin before 21.0426 provides the functionality to let users make restaurant reservations. These reservations are stored and can be listed on an 'Upcoming' page provided by the plugin. An unauthenticated user can fill in the form to make a restaurant...

CVE-2021-24299 ReDi Restaurant Reservations < 21.0426 - Unauthenticated Stored Cross-Site Scripting (XSS)

The ReDi Restaurant Reservation WordPress plugin before 21.0426 provides the functionality to let users make restaurant reservations. These reservations are stored and can be listed on an 'Upcoming' page provided by the plugin. An unauthenticated user can fill in the form to make a restaurant...

CVE-2021-24299

The CVE-2021-24299 entry concerns the ReDi Restaurant Reservation WordPress plugin (versions before 21.0426). An unauthenticated user can submit a reservation with a crafted Comment field that is not properly validated, enabling stored XSS. The payload is later executed when the plugin loads the ...

WordPress plugin 跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress Plugin is a WordPress open source application plugin . A cross-site scripting vulnerability exists in versions o...

WordPress ReDi Restaurant Reservation plugin <= 21.0307 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability

Unauthenticated Stored Cross-Site Scripting XSS vulnerability discovered by Bastijn Ouwendijk in WordPress ReDi Restaurant Reservation plugin versions = 21.0307. Solution Update the WordPress ReDi Restaurant Reservation plugin to the latest available version at least 21.0426...

ReDi Restaurant Reservations < 21.0426 - Unauthenticated Stored Cross-Site Scripting (XSS)

The ReDi Restaurant Reservations plugin provides the functionality to let users make restaurant reservations. These reservations are stored and can be listed on an 'Upcoming' page provided by the plugin. An unauthenticated user can fill in the form to make a restaurant reservation. The form to ma...

ReDi Restaurant Reservations < 21.0426 - Unauthenticated Stored Cross-Site Scripting (XSS)

The ReDi Restaurant Reservations plugin provides the functionality to let users make restaurant reservations. These reservations are stored and can be listed on an 'Upcoming' page provided by the plugin. An unauthenticated user can fill in the form to make a restaurant reservation. The form to ma...

File Upload Vulnerability in Zhongke Yunlian ERP System

Ltd. is a limited company with CloudLink POS-ERP management system and FoodMaker restaurant management system as its main business. A file upload vulnerability exists in Zhongke Yunlian ERP system, which can be exploited by attackers to gain control of the server...

Unauthorized Access Vulnerability in Jinwei Smart Restaurant

Jinwei Smart Restaurant is a free restaurant management software for all kinds of large and small restaurants, as well as fast food, Chinese food, western food, hot pot restaurant and other kinds of catering business. Jinwei Smart Restaurant has an unauthorized access vulnerability that can be...

Uber: IDOR leads to See analytics of Loyalty Program in any restaurant.

Improper authorization allowed for disclosure any restaurant's analytics of the Loyalty Program on 3 endpoints...

Five Star Restaurant Menu < 2.2.1 - Unauthenticated PHP Object Injection

The plugin unserialised the fdmcart cookie value without any sanitisation or validation first, when the Ordering setting of the plugin was enabled, leading to a PHP object injection which could lead to RCE...

WordPress Five Star Restaurant Menu plugin <= 2.2.0 - Unauthenticated Remote Code Execution (RCE) vulnerability

Unauthenticated Remote Code Execution RCE vulnerability discovered by Nick Blundell in WordPress Five Star Restaurant Menu plugin versions = 2.2.0. Solution Update the WordPress Five Star Restaurant Menu plugin to the latest available version at least 2.2.1...

Uber: IDOR leads to leak analytics of any restaurant

The GraphQL service at https://restaurant.uber.com, did not properly perform an authZ check, allowing an attacker to obtain detailed sales statistics, etc for any restaurant. Writeup at https://0xprial.com/idor-leads-to-leak-any-uber-eats-restaurant-analytics/...

Detailed: Here's How Iran Spies on Dissidents with the Help of Hackers

Twin cyber operations conducted by state-sponsored Iranian threat actors demonstrate their continued focus on compiling detailed dossiers on Iranian citizens that could threaten the stability of the Islamic Republic, including dissidents, opposition forces, and ISIS supporters, and Kurdish native...

Friday Squid Blogging: Vegan Chili Squid

The restaurant chain Wagamama is selling a vegan version of its Chilli Squid side dish made from king oyster mushrooms. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Read my blog posting guidelines here...

CVE-2020-26773

Restaurant Reservation System 1.0 suffers from an authenticated SQL injection vulnerability, which allows a remote, authenticated attacker to execute arbitrary SQL commands via the date parameter in includes/reservation.inc.php...

Sql injection

Restaurant Reservation System 1.0 suffers from an authenticated SQL injection vulnerability, which allows a remote, authenticated attacker to execute arbitrary SQL commands via the date parameter in includes/reservation.inc.php...

CVE-2020-26773

CVE-2020-26773 affects the Restaurant Reservation System 1.0. It contains an authenticated SQL injection vulnerability that allows a remote, authenticated attacker to execute arbitrary SQL commands via the date parameter in includes/reservation.inc.php. The issue is reported across multiple sourc...

Sourcecodester Restaurant Reservation System SQL Injection Vulnerability

Sourcecodester Restaurant Reservation System is a Php-based restaurant reservation system by the individual developer of Sourcecodester. A security vulnerability in Restaurant Reservation System 1.0 allows remote, authenticated attackers to execute arbitrary SQL commands via the date parameter in...

CVE-2020-29284

The file view-chair-list.php in Multi Restaurant Table Reservation System 1.0 does not perform input validation on the tableid parameter which allows unauthenticated SQL Injection. An attacker can send malicious input in the GET request to /dashboard/view-chair-list.php?tableid= to trigger the...