PT-2024-17412 · WordPress · Tourfic – Ultimate Hotel Booking

Name of the Vulnerable Software and Affected Versions: Tourfic – Ultimate Hotel Booking, Travel Booking & Apartment Booking WordPress Plugin versions up to, and including, 2.15.3 Description: The issue is related to SQL Injection via the enquiry id parameter of the tf enquiry reply email callback...

WordPress plugin Tourfic SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection...

WordPress Tourfic plugin <= 2.15.3 - Authenticated (Subscriber+) SQL Injection vulnerability

Authenticated Subscriber+ SQL Injection vulnerability discovered by Thái An Thái An in WordPress Plugin Tourfic versions = 2.15.3...

CVE-2024-8319

The Tourfic plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.11.20. This is due to missing or incorrect nonce validation on the tforderstatusemailresendfunction, tfvisitordetailseditfunction, tfcheckinoutdetailseditfunction,...

CVE-2024-8319 Tourfic <= 2.11.20 - Cross-Site Request Forgery in Multiple Functions

The Tourfic plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.11.20. This is due to missing or incorrect nonce validation on the tforderstatusemailresendfunction, tfvisitordetailseditfunction, tfcheckinoutdetailseditfunction,...

WordPress Tourfic plugin <= 2.11.20 - Cross-Site Request Forgery in Multiple Functions vulnerability

Cross-Site Request Forgery in Multiple Functions vulnerability discovered by WordFence in WordPress Plugin Tourfic versions = 2.11.20...

WordPress plugin Tourfic 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site request forge...

WordPress Tourfic Plugin <= 2.11.20 is vulnerable to Cross Site Request Forgery (CSRF)

Software Tourfic Type Plugin Vulnerable versions = 2.11.20 Fixed in 2.11.21 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-8319 Patch priority Low CVSS severity Low 4.3 Developer Themefic PSID 59cc85267376 Credits WordFence Required privilege...

PT-2024-38937 · WordPress · Tourfic

Name of the Vulnerable Software and Affected Versions: The Tourfic plugin for WordPress versions up to, and including, 2.11.20 Description: The issue is due to missing or incorrect nonce validation on several functions, including tf order status email resend function, tf visitor details edit...

Tourfic < 2.11.16 - Authenticated (Subscriber+) Arbitrary File Upload

Description The Tourfic – Ultimate Hotel Booking, Travel Booking & Apartment Booking WordPress Plugin | WooCommerce Booking plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 2.11.15. This makes it possible for...

Tourfic < 2.11.8 - Reflected Cross-Site Scripting

Description The Tourfic plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 2.11.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that...

Tourfic < 2.11.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

Description The Tourfic plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.11.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject...

Tourfic < 2.11.19 - Authenticated (Subscriber+) PHP Object Injection

Description The Tourfic – Ultimate Hotel Booking, Travel Booking & Apartment Booking WordPress Plugin | WooCommerce Booking plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.11.17 via deserialization of untrusted input . This makes it possible for...

CVE-2024-29137

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Themefic Tourfic tourfic.This issue affects Tourfic: from n/a through = 2.11.7...

CVE-2024-29136

Deserialization of Untrusted Data vulnerability in Themefic Tourfic.This issue affects Tourfic: from n/a through 2.11.17...

CVE-2024-29136

Deserialization of Untrusted Data vulnerability in Themefic Tourfic tourfic.This issue affects Tourfic: from n/a through = 2.11.17...

CVE-2024-29137

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Themefic Tourfic allows Reflected XSS.This issue affects Tourfic: from n/a through 2.11.7...

CVE-2024-29135

Unrestricted Upload of File with Dangerous Type vulnerability in Themefic Tourfic tourfic.This issue affects Tourfic: from n/a through = 2.11.15...

CVE-2024-29135

Unrestricted Upload of File with Dangerous Type vulnerability in Tourfic.This issue affects Tourfic: from n/a through 2.11.15...

CVE-2024-29134

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Themefic Tourfic tourfic.This issue affects Tourfic: from n/a through = 2.11.8...