7852 matches found
PT-2019-13373 · WordPress · Appointment Hour Booking
Name of the Vulnerable Software and Affected Versions: Appointment Hour Booking plugin version 1.1.44 Description: The issue allows for XSS via the E-mail field. Recommendations: For version 1.1.44, update to a newer version that contains a fix for this issue...
WordPress Online Lesson Booking plugin <= 0.8.6 - Cross-Site Request Forgery (CSRF) and Cross-Site Scripting (XSS) vulnerabilities
Cross-Site Request Forgery CSRF and Cross-Site Scripting XSS vulnerabilities found by Cryptography Laboratory in WordPress Online Lesson Booking plugin versions = 0.8.6. Solution Update the WordPress Online Lesson Booking plugin to the latest available version at least = 0.8.7...
Appointment Hour Booking <= 1.1.45 - Stored Cross-Site Scripting (XSS)
It is possible for an unauthenticated user to inject malicious JavaScript into a booking form, which will then be executed when an authenticated user views the booking in the WordPress admin interface. PoC POST /booking-form/ HTTP/1.1 Host: test.local User-Agent: Mozilla/5.0 Macintosh; Intel Mac ...
Appointment Hour Booking <= 1.1.45 - Stored Cross-Site Scripting (XSS)
It is possible for an unauthenticated user to inject malicious JavaScript into a booking form, which will then be executed when an authenticated user views the booking in the WordPress admin interface. POST /booking-form/ HTTP/1.1 Host: test.local User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X...
WordPress Appointment Booking Calendar plugin <= 1.3.18 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability
Unauthenticated Stored Cross-Site Scripting XSS vulnerability found in WordPress Appointment Booking Calendar plugin versions = 1.3.18. Solution Update the WordPress Appointment Booking Calendar plugin to the latest available version at least 1.3.19...
CVE-2019-5973
Cross-site request forgery CSRF vulnerability in Online Lesson Booking 0.8.6 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors...
CVE-2019-5972
Cross-site scripting vulnerability in Online Lesson Booking 0.8.6 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
CVE-2019-5972
Cross-site scripting vulnerability in Online Lesson Booking 0.8.6 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
Cross site request forgery (csrf)
Cross-site request forgery CSRF vulnerability in Online Lesson Booking 0.8.6 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors...
Cross site scripting
Cross-site scripting vulnerability in Online Lesson Booking 0.8.6 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
CVE-2019-5972
Cross-site scripting vulnerability in Online Lesson Booking 0.8.6 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
CVE-2019-5972
CVE-2019-5972 affects the WordPress plugin Online Lesson Booking (versions 0.8.6 and earlier). It is a stored cross-site scripting (CWE-79) vulnerability that could allow remote attackers to inject arbitrary script/HTML, potentially executing in the browser of users with administrative privileges...
CVE-2019-5973
Cross-site request forgery CSRF vulnerability in Online Lesson Booking 0.8.6 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors...
CVE-2019-5973
CVE-2019-5973 is a CSRF vulnerability in the WordPress Plugin “Online Lesson Booking” that affects version 0.8.6 and earlier. The flaw allows remote attackers to hijack an administrator’s authenticated session via unspecified vectors, potentially enabling unintended actions while the administrato...
PT-2019-17907 · Unknown · Online Lesson Booking
Name of the Vulnerable Software and Affected Versions: Online Lesson Booking versions 0.8.6 and earlier Description: A cross-site request forgery issue allows remote attackers to hijack the authentication of administrators. Recommendations: For versions 0.8.6 and earlier, update to a version late...
Appointment Booking Calendar < 1.3.19 - Unauthenticated Stored XSS
Lack of authorisation check in the cpabcappointmentssaveedition function can lead to stored XSS via the editionarea parameter when cfwppedit is set to 'js' or 'css' /wp-admin/admin-ajax.php" method="POST" "/ /wp-admin/admin-ajax.php" method="POST" "/ The payload will be triggered in all pages wit...
Appointment Booking Calendar < 1.3.19 - Unauthenticated Stored XSS
Lack of authorisation check in the cpabcappointmentssaveedition function can lead to stored XSS via the editionarea parameter when cfwppedit is set to 'js' or 'css' PoC The payload will be triggered in all pages with a booking form...
CVE-2018-17842
SQL injection exists in Scriptzee Hotel Booking Engine 1.0 via the hotels hroomtype parameter...