CVE-2021-37333

Laravel Booking System Booking Core 2.0 is vulnerable to Session Management. A password change at sandbox.bookingcore.org/user/profile/change-password does not invalidate a session that is opened in a different browser...

Session fixation

Laravel Booking System Booking Core 2.0 is vulnerable to Session Management. A password change at sandbox.bookingcore.org/user/profile/change-password does not invalidate a session that is opened in a different browser...

Cross site scripting

Laravel Booking System Booking Core 2.0 is vulnerable to Cross Site Scripting XSS. The Avatar upload in the My Profile section could be exploited to upload a malicious SVG file which contains Javascript. Now if another user/admin views the profile and clicks to view his avatar, an XSS will trigge...

CVE-2021-37333

CVE-2021-37333 affects the Laravel Booking System Booking Core 2.0. The vulnerability is a Session Management issue where changing a password via sandbox.bookingcore.org/user/profile/change-password does not invalidate an active session in another browser, allowing continued access after a passwo...

CVE-2021-37333

Laravel Booking System Booking Core 2.0 is vulnerable to Session Management. A password change at sandbox.bookingcore.org/user/profile/change-password does not invalidate a session that is opened in a different browser...

CVE-2021-37331

CVE-2021-37331 affects Booking Core 2.0 (Laravel Booking System). The issue is an Incorrect Access Control on the Verifications page: after uploading an ID Card or Trade License, an attacker can view their own document, and by changing the URL, view IDs/licenses of other vendors/users. Documents ...

CVE-2021-37330

Laravel Booking System Booking Core 2.0 is vulnerable to Cross Site Scripting XSS. The Avatar upload in the My Profile section could be exploited to upload a malicious SVG file which contains Javascript. Now if another user/admin views the profile and clicks to view his avatar, an XSS will trigge...

CVE-2021-37330

The CVE refers to CVE-2021-37330 affecting Laravel Booking System Booking Core 2.0. The vulnerability is a Cross Site Scripting (XSS) in the Avatar upload on the My Profile page, where uploading a malicious SVG containing Javascript could trigger an XSS when another user/admin views the avatar. D...

Laravel Booking System Booking Core 代码问题漏洞

A code issue vulnerability exists in Laravel Booking System Booking Core, a reservation system, which originates from sandbox.bookingcore.org/user/profile/change- password does not invalidate a session opened in a different browser. No details of the vulnerability are currently available...

Booking Core has an unspecified vulnerability

Booking Core is an application. A Laravel-based booking system designed for travel websites, malls, travel agents, tour operators, B&Bs, villa rentals, resort rentals, Make Travel websites.Booking Core has a security vulnerability that stems from the subscription functionality in Ultimate Booking...

CVE-2020-25445

The “Subscribe” feature in Ultimate Booking System Booking Core 1.7.0 is vulnerable to CSV formula injection. The input containing the excel formula is not being sanitized by the application. As a result when admin in backend download and open the csv, content of the cells are executed...

CVE-2020-25445

The “Subscribe” feature in Ultimate Booking System Booking Core 1.7.0 is vulnerable to CSV formula injection. The input containing the excel formula is not being sanitized by the application. As a result when admin in backend download and open the csv, content of the cells are executed...

CVE-2020-27379

Cross Site Request Forgery CSRF vulnerability in Booking Core - Ultimate Booking System Booking Core 1.7.0 . The CSRF token is not being validated when the request is sent as a GET method. This results in an unauthorized change in the user's email ID, which can later be used to reset the password...

Cross site scripting

Cross Site Scripting XSS vulnerability in Booking Core - Ultimate Booking System Booking Core 1.7.0 via the 1 "About Yourself” section under the “My Profile” page, " 2 “Hotel Policy” field under the “Hotel Details” page, 3 “Pricing code” and “name” fields under the “Manage Tour” page, and 4 all t...

Cross site request forgery (csrf)

Cross Site Request Forgery CSRF vulnerability in Booking Core - Ultimate Booking System Booking Core 1.7.0 . The CSRF token is not being validated when the request is sent as a GET method. This results in an unauthorized change in the user's email ID, which can later be used to reset the password...

Input validation

The “Subscribe” feature in Ultimate Booking System Booking Core 1.7.0 is vulnerable to CSV formula injection. The input containing the excel formula is not being sanitized by the application. As a result when admin in backend download and open the csv, content of the cells are executed...

CVE-2020-25445

The CVE-2020-25445 entry concerns Booking Core 1.7.0 (Ultimate Booking System) where the Subscribe feature does not sanitize CSV cells, allowing CSV formula injection when a backend admin downloads and opens the generated CSV. The underlying issue is improper input handling in the subscription/ex...

CVE-2020-27379

CVE-2020-27379 affects Booking Core (Ultimate Booking System) Booking Core 1.7.0. The root cause is CSRF token validation failure when requests are sent via GET, allowing unauthorized changes to a user’s email ID. This could enable password resets using the modified email. The available connected...

CVE-2020-25444

Cross Site Scripting XSS vulnerability in Booking Core - Ultimate Booking System Booking Core 1.7.0 via the 1 "About Yourself” section under the “My Profile” page, " 2 “Hotel Policy” field under the “Hotel Details” page, 3 “Pricing code” and “name” fields under the “Manage Tour” page, and 4 all t...

CVE-2020-25444

CVE-2020-25444 affects Booking Core – Ultimate Booking System (Booking Core) version 1.7.0. The vulnerability is a Cross-Site Scripting (XSS) flaw exploitable via multiple input points: the My Profile page’s About Yourself section, Hotel Details’ Hotel Policy field, Manage Tour’s Pricing code and...