Availability Booking Calendar PHP 跨站脚本漏洞

Availability Booking Calendar PHP is GZ Scripts open source an availability booking calendar system . Availability Booking Calendar PHP v1.0 version of a cross-site scripting vulnerability , the vulnerability stems from the file index.php parameter promocode on the user-supplied data lack of...

CVE-2021-24606

The Availability Calendar WordPress plugin before 1.2.1 does not escape the category attribute from its shortcode before using it in a SQL statement, leading to a SQL Injection issue, which can be exploited by any user able to add shortcode to posts/pages, such as contributor+...

CVE-2021-24604

The Availability Calendar WordPress plugin before 1.2.2 does not sanitise or escape its Category Names before outputting them in page/post where the associated shortcode is embed, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml is disallowed...

CVE-2021-24604

The Availability Calendar WordPress plugin before 1.2.2 does not sanitise or escape its Category Names before outputting them in page/post where the associated shortcode is embed, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml is disallowed...

Sql injection

The Availability Calendar WordPress plugin before 1.2.1 does not escape the category attribute from its shortcode before using it in a SQL statement, leading to a SQL Injection issue, which can be exploited by any user able to add shortcode to posts/pages, such as contributor+...

CVE-2021-24606

The Availability Calendar WordPress plugin before 1.2.1 does not escape the category attribute from its shortcode before using it in a SQL statement, leading to a SQL Injection issue, which can be exploited by any user able to add shortcode to posts/pages, such as contributor+...

CVE-2021-24604

The Availability Calendar WordPress plugin before 1.2.2 does not sanitise or escape its Category Names before outputting them in page/post where the associated shortcode is embed, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml is disallowed...

CVE-2021-24606

The CVE-2021-24606 entry affects the Availability Calendar WordPress plugin (before 1.2.1). The root cause is failure to escape the category attribute in the shortcode before it is used in a SQL statement, resulting in an authenticated SQL injection vulnerability. Impact is that a user who can in...

CVE-2021-24604

The CVE-2021-24604 affects the Availability Calendar WordPress plugin (pre-1.2.2). The root cause is failure to sanitize/escape Category Names before they are output in pages/posts using the related shortcode, enabling authenticated, high-privilege users to perform cross-site scripting (XSS). The...

WordPress 插件 SQL注入漏洞

WordPress Plugin is an open source application plugin for WordPress. The WordPress plugin suffers from a SQL injection vulnerability that stems from the Availability Calendar plugin prior to version 1.2.1 that does not escape the category attribute from its shortcode before using it in a SQL...

WordPress 插件跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports personal blog sites on servers running PHP and MySQL.WordPress Plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists in...

Availability Calendar < 1.2.2 - Authenticated Stored Cross-Site Scripting

The plugin does not sanitise or escape its Category Names before outputting them in page/post where the associated shortcode is embed, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml is disallowed PoC Create a new category via the plugin...

WordPress Diary & Availability Calendar plugin <= 1.0.3 - Authenticated SQL Injection (SQLi) vulnerability

Authenticated SQL Injection SQLi vulnerability discovered by Shreya Pohekar in WordPress Diary & Availability Calendar plugin versions = 1.0.3. Solution This plugin has been closed as of May 19, 2021 and is not available for download. Reason: Security Issue...

Ajax Availability Calendar 3.x.x - Multiple Vulnerabilties

No description provided by source. Ajax Availability Calendar 3.X.X Multiple Vulnerabilties ============================================================== .:. Author : AtT4CKxT3rR0r1ST [email protected] .:. Script : http://www.ajaxavailabilitycalendar.com/ .:. Dork : intitle:Ajax Availability Calendar ...

Ajax Availability Calendar 3.x - Multiple Vulnerabilities

Ajax Availability Calendar 3.x - Multiple Vulnerabilities Ajax Availability Calendar 3.X.X Multiple Vulnerabilties ============================================================== .:. Author : AtT4CKxT3rR0r1ST [email protected] .:. Script : http://www.ajaxavailabilitycalendar.com/ .:. Dork : intitle:"Aja...

Ajax Availability Calendar 3.x - Multiple Vulnerabilities

Ajax Availability Calendar 3.X.X Multiple Vulnerabilties ============================================================== .:. Author : AtT4CKxT3rR0r1ST [email protected] .:. Script : http://www.ajaxavailabilitycalendar.com/ .:. Dork : intitle:"Ajax Availability Calendar" , inurl:"/ac-admin/index.php" ===...

Ajax Availability Calendar 3.X.X Multiple Vulnerabilties

Exploit for php platform in category web applications Ajax Availability Calendar 3.X.X Multiple Vulnerabilties ============================================================== .:. Author : AtT4CKxT3rR0r1ST email protected .:. Script : http://www.ajaxavailabilitycalendar.com/ .:. Dork : intitle:"Aja...

Joomla Component com_rentalot SQL Injection Vulnerability

Exploit for php platform in category web applications ========================================================= Joomla Component comrentalot SQL Injection Vulnerability ========================================================= 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-...