Code injection

Online Ticket Booking has XSS via the admin/newsedit.php newstitle parameter...

CVE-2018-5075

Online Ticket Booking has XSS via the admin/snacksedit.php snacksname parameter...

CVE-2018-5078

Online Ticket Booking has XSS via the admin/eventlist.php cast parameter...

CVE-2018-5074

Online Ticket Booking has XSS via the admin/manageownerlist.php contact parameter...

CVE-2018-5072

Online Ticket Booking has XSS via the admin/sitesettings.php keyword parameter...

CVE-2018-5073

Online Ticket Booking has CSRF via admin/movieedit.php...

CVE-2018-5078

The CVE-2018-5078 entry concerns a Cross-Site Scripting (XSS) vulnerability in the Online Ticket Booking system, exploitable via the admin/eventlist.php cast parameter. Connected sources consistently describe XSS as the flaw and point to the same parameter as the vector, but there are no accompan...

CVE-2018-5077

CVE-2018-5077 is described across multiple sources as an XSS vulnerability in Online Ticket Booking, exploitable via the admin/movieedit.php moviename parameter. The NVD entry lists a network-accessible, low-medium severity issue with CVSS v3.0 base score 4.8 (I/L, C/L) and a CVSS v2 base score 3...

CVE-2018-5076

CVE-2018-5076 is a Cross-Site Scripting (XSS) vulnerability affecting the Online Ticket Booking component of the Advanced Real Estate Script family. Multiple sources (NVD, Red Hat advisory, CNVD) describe an XSS flaw that can be exploited via the admin/newsedit.php news title parameter, enabling ...

CVE-2018-5075

CVE-2018-5075 specifies an XSS vulnerability in Online Ticket Booking, exploitable via the admin/snacks_edit.php snacks_name parameter. The available connected documents confirm the affected application path and vulnerability class (XSS) but do not provide exploit code, affected versions, remedia...

CVE-2018-5074

CVE-2018-5074 is described across sources as an XSS vulnerability in Online Ticket Booking, exploitable via the admin/manageownerlist.php contact parameter. Multiple documents (NVD, Red Hat, CVE lists) corroborate the description. The NVD entry lists two CVSS vectors: CVSSv2 base score 3.5 (LOW) ...

CVE-2018-5073

CVE-2018-5073 affects the Online Ticket Booking system, with a CSRF vulnerability in the admin/movieedit.php endpoint. The issue allows forged requests to be sent on behalf of an authenticated admin, potentially enabling unauthorized actions. The CVE entry lists CVSS metrics (2.0/3.0) indicating ...

CVE-2018-5072

CVE-2018-5072 describes a Cross-Site Scripting (XSS) vulnerability in Online Ticket Booking, exploitable via the admin/sitesettings.php keyword parameter. Multiple connected records confirm the issue and describe the impact as XSS, with CVSS scores from NVD indicating low–medium severity (base sc...

CVE-2018-5077

Online Ticket Booking has XSS via the admin/movieedit.php moviename parameter...

CVE-2018-5076

Online Ticket Booking has XSS via the admin/newsedit.php newstitle parameter...

CVE-2018-5075

Online Ticket Booking has XSS via the admin/snacksedit.php snacksname parameter...

CVE-2018-5078

Online Ticket Booking has XSS via the admin/eventlist.php cast parameter...

FreeBSD : OTRS -- Multiple vulnerabilities (cebd05d6-ed7b-11e7-95f2-005056925db4)

OTRS reports : An attacker who is logged into OTRS as an agent can request special URLs from OTRS which can lead to the execution of shell commands with the permissions of the web server user. An attacker who is logged into OTRS as a customer can use the ticket search form to disclose internal...

CVE-2017-10910

MQTT.js 2.x.x prior to 2.15.0 issue in handling PUBLISH tickets may lead to an attacker causing a denial-of-service condition...

VulnCheck KEV: CVE-2017-14321

Multiple cross-site scripting XSS vulnerabilities in the administrative interface in Mirasvit Helpdesk MX before 1.5.3 allow remote attackers to inject arbitrary web script or HTML via the 1 customer name or 2 subject in a ticket...