WordPress plugin 跨站脚本漏洞

WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. The platform supports the hosting of personal blogging sites on servers with PHP and MySQL. WordPress WP Booking System plugin has a cross-site scripting vulnerability in versions prior to 2.0.15...

CVE-2021-45003

Laundry Booking Management System 1.0 Latest and previous versions are affected by a remote code execution RCE vulnerability in profile.php through the "image" parameter that can execute a webshell payload...

CVE-2021-45003

Laundry Booking Management System 1.0 Latest and previous versions are affected by a remote code execution RCE vulnerability in profile.php through the "image" parameter that can execute a webshell payload...

Remote code execution

Laundry Booking Management System 1.0 Latest and previous versions are affected by a remote code execution RCE vulnerability in profile.php through the "image" parameter that can execute a webshell payload...

WP Booking System – Booking Calendar < 2.0.15 - Authenticated Reflected Cross-Site Scripting (XSS)

The plugin was affected by a reflected xss in wp-booking-system on the wpbs-calendars admin page. http://127.0.0.1:8001/wp-admin/admin.php?page=wpbs-calendars&s=%22+style%3Danimation-name%3Arotation+onanimationstart%3Dalert%281%29+x%3D or...

WP Booking System – Booking Calendar < 2.0.15 - Authenticated Reflected Cross-Site Scripting (XSS)

The plugin was affected by a reflected xss in wp-booking-system on the wpbs-calendars admin page. PoC http://127.0.0.1:8001/wp-admin/admin.php?page=wpbs-calendars=%22+style%3Danimation-name%3Arotation+onanimationstart%3Dalert%281%29+x%3D or...

WordPress WP Booking System plugin <= 2.0.14 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability

Authenticated Reflected Cross-Site Scripting XSS vulnerability discovered by Krzysztof Zając in WordPress WP Booking System plugin versions = 2.0.14. Solution Update the WordPress WP Booking System plugin to the latest available version at least 2.0.15...

CVE-2021-42667

A SQL Injection vulnerability exists in Sourcecodester Online Event Booking and Reservation System in PHP in event-management/views. An attacker can leverage this vulnerability in order to manipulate the sql query performed. As a result he can extract sensitive data from the web server and in som...

Design/Logic Flaw

An HTML injection vulnerability exists in Sourcecodester Online Event Booking and Reservation System in PHP/MySQL via the msg parameter to /event-management/index.php. An attacker can leverage this vulnerability in order to change the visibility of the website. Once the target user clicks on a...

CVE-2021-42663

An HTML injection vulnerability exists in Sourcecodester Online Event Booking and Reservation System in PHP/MySQL via the msg parameter to /event-management/index.php. An attacker can leverage this vulnerability in order to change the visibility of the website. Once the target user clicks on a...

Engineers Online Portal SQL注入漏洞

Sourcecodester Online Event Booking and Reservation System is developed using PHP, MySQL database, HTML, CSS, Javascript, Bootstrap and AdminLTE. The system can be accessed by three types of users, namely system administrators, students, and instructors. sourcecodester Online Event Booking and...

CVE-2021-42223

Cross Site Scripting XSS.vulnerability exists in Online DJ Booking Management System 1.0 in view-booking-detail.php...

Online Dj Booking Management System 跨站脚本漏洞

Online Dj Booking Management System is an online Dj booking management system by the individual developer Anuj Kumar. Online DJ Booking Management System suffers from a cross-site scripting vulnerability that originates from Online DJ Booking Management System 1.0 in view-booking-detail.php. An...

Laravel Booking System Booking Core代码问题漏洞

A code issue vulnerability exists in Laravel Booking System Booking Core, a reservation system, which originates from sandbox.bookingcore.org/user/profile/change- password does not invalidate a session opened in a different browser. No details of the vulnerability are currently available...

Online DJ Booking Management System 1.0 - (Multiple) Blind Cross-Site Scripting Vulnerability

Exploit Title: Online DJ Booking Management System 1.0 - 'Multiple' Blind Cross-Site Scripting Exploit Author: Yash Mahajan Vendor Homepage: https://phpgurukul.com/ Software Link: https://phpgurukul.com/online-dj-booking-management-system-using-php-and-mysql/ Version: V 1.0 Vulnerable endpoint:...

CVE-2021-37330

Laravel Booking System Booking Core 2.0 is vulnerable to Cross Site Scripting XSS. The Avatar upload in the My Profile section could be exploited to upload a malicious SVG file which contains Javascript. Now if another user/admin views the profile and clicks to view his avatar, an XSS will trigge...

CVE-2021-37331

Laravel Booking System Booking Core 2.0 is vulnerable to Incorrect Access Control. On the Verifications page, after uploading an ID Card or Trade License and viewing it, ID Cards and Trade Licenses of other vendors/users can be viewed by changing the URL...

CVE-2021-37330

Laravel Booking System Booking Core 2.0 is vulnerable to Cross Site Scripting XSS. The Avatar upload in the My Profile section could be exploited to upload a malicious SVG file which contains Javascript. Now if another user/admin views the profile and clicks to view his avatar, an XSS will trigge...

CVE-2021-37333

Laravel Booking System Booking Core 2.0 is vulnerable to Session Management. A password change at sandbox.bookingcore.org/user/profile/change-password does not invalidate a session that is opened in a different browser...

Session fixation

Laravel Booking System Booking Core 2.0 is vulnerable to Session Management. A password change at sandbox.bookingcore.org/user/profile/change-password does not invalidate a session that is opened in a different browser...