WordPress WP Booking System <= 1.5.1.1 - CSRF vulnerability to Authenticated SQL Injection vulnerability

CSRF vulnerability to Authenticated SQL Injection vulnerability possible in WordPress WP Booking System versions = 1.5.1.1 found by Magnus K. Stubman. Solution Update the WordPress WP Booking System to the latest available version at least 1.5.2...

WP Booking System <= 1.5.1.1 - CSRF to Authenticated SQL Injection

According to the original researcher, no CSRF nonces were present and therefore could be exploited by chaining with the CSRF issue...

WordPress WP Booking System Plugin < 1.5.2 CSRF Vulnerability

The WordPress plugin Copyright C 2019 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the...

CVE-2019-12239

The WP Booking System plugin 1.5.1 for WordPress has no CSRF protection, which allows attackers to reach certain SQL injection issues that require administrative access...

CVE-2019-12239

The CVE-2019-12239 entry concerns the WordPress WP Booking System plugin (version 1.5.1) with a lack of CSRF protection, which allows reaching SQL injection issues that require administrative access. Connected documents confirm this vulnerability and its remediation guidance, e.g., Patchstack and...

PT-2019-12710 · WordPress · Wp Booking System

Name of the Vulnerable Software and Affected Versions: WP Booking System plugin version 1.5.1 Description: The issue is related to the lack of CSRF protection, which can allow attackers to exploit certain SQL injection issues that require administrative access. Recommendations: For WP Booking...

CVE-2019-12239: Improper Neutralization of Special Elements used in an SQL Command

The WP Booking System plugin 1.5.1 for WordPress has no CSRF protection, which allows attackers to reach certain SQL injection issues that require administrative access...

CVE-2018-10363

An issue was discovered in the WpDevArt "Booking calendar, Appointment Booking System" plugin 2.2.2 for WordPress. Multiple parameters allow remote attackers to manipulate the values to change data such as prices...

CVE-2018-10363

An issue was discovered in the WpDevArt "Booking calendar, Appointment Booking System" plugin 2.2.2 for WordPress. Multiple parameters allow remote attackers to manipulate the values to change data such as prices...

CVE-2018-10363

The CVE-2018-10363 entry applies to the WordPress plugin “Booking calendar, Appointment Booking System” by WpDevArt, version 2.2.2. The vulnerability is described as an issue where multiple parameters can be manipulated by a remote attacker to change data such as prices. The connected documents c...

CVE-2018-10363: Improper Input Validation

An issue was discovered in the WpDevArt "Booking calendar, Appointment Booking System" plugin 2.2.2 for WordPress. Multiple parameters allow remote attackers to manipulate the values to change data such as prices...

BookingWizz Booking System 5.5 - 'id' SQL Injection

Exploit Title: BookingWizz Booking System 5.5 - 'bs-services-add.php' SQL Injection Dork: N/A Date: 27.05.2018 Exploit Author: Özkan Mustafa Akkuş AkkuS Vendor Homepage: https://codecanyon.net/item/booking-system/87919 Version: 5.5 Category: Webapps Tested on: Kali linux Description : The service...

NodAPS 4.0 Cross Site Request Forgery / SQL Injection

Exploit Title: Online Booking system - NodAPS 4.0 - 'search' SQL injection / Cross-Site Request Forgery Date: 2018-05-16 Exploit Author: Borna nematzadeh L0RD Vendor Homepage: https://codecanyon.net/item/appointment-management-system-nodaps/16197805?srank=1535 Version: 4.0 Tested on: windows...

NodAPS 4.0 - SQL injection / Cross-Site Request Forgery Vulnerabilities

Exploit for php platform in category web applications Exploit Title: Online Booking system - NodAPS 4.0 - 'search' SQL injection / Cross-Site Request Forgery Exploit Author: Borna nematzadeh L0RD Vendor Homepage: https://codecanyon.net/item/appointment-management-system-nodaps/16197805?srank=1535...

NodAPS 4.0 - SQL injection / Cross-Site Request Forgery

Exploit Title: Online Booking system - NodAPS 4.0 - 'search' SQL injection / Cross-Site Request Forgery Date: 2018-05-16 Exploit Author: Borna nematzadeh L0RD Vendor Homepage: https://codecanyon.net/item/appointment-management-system-nodaps/16197805?srank=1535 Version: 4.0 Tested on: windows...

NodAPS 4.0 - SQL injection Cross-Site Request Forgery

NodAPS 4.0 - SQL injection Cross-Site Request Forgery Exploit Title: Online Booking system - NodAPS 4.0 - 'search' SQL injection / Cross-Site Request Forgery Date: 2018-05-16 Exploit Author: Borna nematzadeh L0RD Vendor Homepage:...

roombookingsystem.co.uk XSS vulnerability

Open Bug Bounty ID: OBB-547379 Description| Value ---|--- Affected Website:| roombookingsystem.co.uk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Online Hotel Booking System Pro 1.3 SQL Injection

==================================================================================================== | Title : Online Hotel Booking System Pro 1.3 Sql injection vulnerability | | Author : indoushka | | email : [email protected] | | Tested on : windows 10 FranASSais V.Pro | | Version : 1.3 ...

Joomla JomHoliday 4.0 SQL Injection Vulnerability

Exploit for php platform in category web applications Title: Joomla JomHoliday 4.0 - SQL Injection Credit: Bilal KARDADOU Vendor: http://comdev.eu URL: https://extensions.joomla.org/extensions/extension/vertical-markets/booking-a-reservations/jomholiday/ Product: 'Joomla JomHoliday 4.0' Developer...

Online Hotel Booking System Pro 1.3 Cross Site Scripting Vulnerability

Online Hotel Booking System Pro version 1.3 suffers from a cross site scripting vulnerability. Exploit Title: Online Hotel Booking System Pro 1.3 - Cross Site Scripting Google Dork: N/A Date: 2017/08/12 Exploit Author: ShanoWeb Author Mail : MrdotNet2NetatGmaildotcom Vendor Homepage:...