CVE-2025-25965

CVE-2025-25965: Межсайтовая подделка запроса CSRF в Online Banquet Booking System v1.2 Введение Межсайтовая подделка запроса CSRF остается одной из наиболее недооцененных, но опасных уязвимостей, затрагивающих современные веб-приложения. CVE-2025-25965 — это недавно обнаруженная CSRF-уязвимость в...

CVE-2024-57429

CVE-2024-57429 PHPJabbers Cinema Booking System v2.0의 pjActionUpdate 함수에 있는 사이트 간 요청 위조CSRF 취약점으로, 원격 공격자가 인증된 관리자를 속여 승인되지 않은 요청을 제출하게 함으로써 권한을 상승시킬 수 있습니다. 영향: 이 CSRF 취약점을 악용하면 다음과 같은 무단 작업이 발생할 수 있습니다. 관리자의 비밀번호를 변경하여 사실상 관리자를 잠그는 행위. 사용자 역할을 업데이트하여 공격자의 권한을 관리자로 상승시키는 행위. 익스플로잇 - 개념 증명POC 사이트...

CVE-2025-22785

CVE-2025-22785 Course Booking System = 6.0.5 - 인증되지 않은 SQL Injection 설명 WordPress용 Course Booking System 플러그인은 버전 6.0.5 이하에서 사용자가 제공한 매개변수에 대한 이스케이프 처리가 부족하고 기존 SQL 쿼리에 대한 충분한 준비가 이루어지지 않아 SQL Injection에 취약합니다. 이로 인해 인증되지 않은 공격자가 기존 쿼리에 추가 SQL 쿼리를 삽입하여 데이터베이스에서 민감한 정보를 추출할 수 있습니다. 세부 사항 유형 : 플러그인...

cve-disclosures

CVE 공개 — Aman Bahiniya 2024년 12월 MITRE에서 지정한 세 개의 CVE입니다. 레코드는 예약되었지만 게시되지 않아 아직 색인된 항목이 없습니다. 이 저장소는 권고문을 게시하여 CVE가 검색 가능하고 크레딧이 인정되도록 합니다...

CVE-2025-7753

🚨 CVE-2025-7753 — SQL 인젝션 PoC 익스플로잇 저자: Byte Reaper 텔레그램: @ByteReaper0 CVE: CVE‑2025‑7753 취약점: 인증되지 않은 사용자의 시간 기반 SQL 인젝션 🔍 개요 Online Appointment Booking System 1.0 Code‑Projects의 /admin/adddoctor.php 파일에 심각한 SQL 인젝션 취약점이 존재합니다. username 매개변수가 적절히 검증되지 않아, 원격 공격자가 임의의 SQL 쿼리시간 기반, 오류 기반, UNION 기반...

CVE-2026-81793

Unauthenticated Broken Access Control in Salon booking system = 10.31.5 versions...

EUVD-2026-75524

Unauthenticated Broken Access Control in Salon booking system = 10.31.5 versions...

CVE-2026-81793

An unauthenticated Broken Access Control vulnerability affects the WordPress Salon booking system plugin in versions 10.31.5 and earlier . Discovered by Tiago Ventura (@perses), the flaw allows attackers to access or modify data with low integrity and low availability impact without requiring any...

CVE-2026-81793 WordPress Salon booking system plugin <= 10.31.5 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Salon booking system = 10.31.5 versions...

WordPress Salon booking system plugin <= 10.31.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Tiago Ventura @perses in WordPress Plugin Salon booking system versions = 10.31.5...

CVE-2025-46181-XSS

CVE-2025-46181 - Отражённый XSS в системе онлайн-записи на приём CVE-ID : CVE-2025-46181 Обнаружено : Shemkumar P shemkumar.github.io Тип уязвимости : Отражённый межсайтовый скриптинг XSS Серьёзность : Средняя Статус : Раскрыто, назначен CVE от MITRE ✨ Описание Отражённая межсайтовая скриптинг XS...

cve-disclosures

CVE Disclosures — Aman Bahiniya Three CVEs assigned by MITRE...

WordPress Salon booking system plugin <= 10.31.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Daniel Dhaniswara in WordPress Plugin Salon booking system versions = 10.31.1...

WordPress Salon booking system plugin <= 10.31.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Salon booking system versions = 10.31.1...

WordPress Salon Booking System - Free Version plugin < 10.30.34 - Unauthenticated Arbitrary Booking Total Tampering vulnerability

WordPress Salon Booking System - Free Version plugin 10.30.34 - Unauthenticated Arbitrary Booking Total Tampering vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Salon booking system versions 10.30.34...

CVE-2026-14334

The Booking calendar, Appointment Booking System WordPress plugin through 3.2.36 does not properly sanitize uploaded SVG files, allowing unauthenticated attackers to upload a file that bypasses the Booking calendar, Appointment Booking System WordPress plugin through 3.2.36's script-stripping and...

CVE-2026-14334 Booking calendar, Appointment Booking System <= 3.2.36 - Unauthenticated Stored XSS via SVG File Upload

The Booking calendar, Appointment Booking System WordPress plugin through 3.2.36 does not properly sanitize uploaded SVG files, allowing unauthenticated attackers to upload a file that bypasses the Booking calendar, Appointment Booking System WordPress plugin through 3.2.36's script-stripping and...

CVE-2026-14334

The Booking calendar, Appointment Booking System WordPress plugin (versions up to 3.2.36) fails to sanitize uploaded SVG files, allowing unauthenticated attackers to inject JavaScript that executes in an administrator's session when reviewing a submitted booking. CVSS 3.1 base score is 8.8 (HIGH)...

EUVD-2026-62264

The Booking calendar, Appointment Booking System WordPress plugin through 3.2.36 does not properly sanitize uploaded SVG files, allowing unauthenticated attackers to upload a file that bypasses the Booking calendar, Appointment Booking System WordPress plugin through 3.2.36's script-stripping and...

PT-2026-78278

Name of the Vulnerable Software and Affected Versions Booking calendar, Appointment Booking System WordPress plugin versions prior to 3.2.37 Description The plugin fails to properly sanitize uploaded SVG files. This allows unauthenticated attackers to upload a file that bypasses the...