CVE-2017-2150

Directory traversal vulnerability in Booking Calendar version 7.0 and earlier allows remote attackers to read arbitrary files via specially crafted captchachalange parameter...

CVE-2017-2151

The CVE-2017-2151 entry concerns the WordPress plugin Booking Calendar (versions 7.1 and earlier). The vulnerability is a stored cross-site scripting (XSS) flaw that allows remote attackers to inject arbitrary HTML/script via unspecified vectors, potentially executing in a user’s browser. Affecte...

CVE-2017-2151

Cross-site scripting vulnerability in Booking Calendar version 7.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2017-2150

The CVE-2017-2150 entry concerns the WordPress plugin Booking Calendar (versions 7.0 and earlier). Affected component: the Booking Calendar plugin’s captcha_chalange handling. Root cause: directory traversal vulnerability that enables a remote attacker to read arbitrary files by crafting the inpu...

WordPress plugin "Booking Calendar" vulnerable to cross-site scripting

Overview The WordPress plugin "Booking Calendar" provided by wpdevelop contains a stored cross-site scripting vulnerability CWE-79. Satoshi Takagi of Cryptography Laboratory,Department of Information and Communication Engineering,Tokyo Denki University reported this vulnerability to IPA. JPCERT/C...

WordPress plugin "Booking Calendar" vulnerable to directory traversal

Overview The WordPress plugin "Booking Calendar" provided by wpdevelop contains a directory traversal vulnerability CWE-22. ASAI Ken reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact A local file outside of th...

JVN#54762089: WordPress plugin "Booking Calendar" vulnerable to cross-site scripting

The WordPress plugin "Booking Calendar" provided by wpdevelop contains a stored cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the web browser of a user accessing the page generated by the application. Solution Update the Software Update to the latest...

JVN#18739672: WordPress plugin "Booking Calendar" vulnerable to directory traversal

The WordPress plugin "Booking Calendar" provided by wpdevelop contains a directory traversal vulnerability CWE-22. Impact A local file outside of the application on the server may be accessed by a remote attacker. Solution Update the Software Update to the latest version according to the...

Joomla Modern Booking,1.0,SQL Injection

Joomla Modern Booking,1.0,SQL Injection new version number 2.0.0 UpdateNotice URL https://www.unikalus.com/announcements.html...

WordPress plugin Booking Calendar plugin cross-site scripting vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress plugin Booking Calendar plugin version 7.1 and earlier versions, whi...

WordPress Booking Calendar Plugin Directory Traversal Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A directory traversal vulnerability exists in WordPress plugin Booking Calendar plugin version 7.0 and earlier versions, whic...

Professional Bus Booking Script - hid_Busid Parameter SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Professional Bus Booking Script - SQL Injection Google Dork: N/A Date: 27.03.2017 Vendor Homepage: http://travelbookingscript.com/ Software: http://travelbookingscript.com/professional-bus-booking-script.html Demo:...

Professional Bus Booking Script - hid_Busid Parameter SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Professional Bus Booking Script - SQL Injection Google Dork: N/A Date: 27.03.2017 Vendor Homepage: http://travelbookingscript.com/ Software: http://travelbookingscript.com/professional-bus-booking-script.html Demo:...

Hotel Booking Script 1.0 - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Hotel & Tour Package Script v1.0 - SQL Injection Google Dork: N/A Date: 26.03.2017 Vendor Homepage: http://eagletechnosys.com/ Software: http://www.eaglescripts.com/hotel-booking-script Demo:...

Professional Bus Booking Script - hid_Busid SQL Injection

Professional Bus Booking Script - hidBusid SQL Injection Exploit Title: Professional Bus Booking Script - SQL Injection Google Dork: N/A Date: 27.03.2017 Vendor Homepage: http://travelbookingscript.com/ Software: http://travelbookingscript.com/professional-bus-booking-script.html Demo:...

Professional Bus Booking Script - 'hid_Busid' SQL Injection

Exploit Title: Professional Bus Booking Script - SQL Injection Google Dork: N/A Date: 27.03.2017 Vendor Homepage: http://travelbookingscript.com/ Software: http://travelbookingscript.com/professional-bus-booking-script.html Demo: http://travelbookingscript.com/demo/professional/ Version: N/A Test...

Professional Bus Booking Script SQL Injection

Exploit Title: Professional Bus Booking Script - SQL Injection Google Dork: N/A Date: 27.03.2017 Vendor Homepage: http://travelbookingscript.com/ Software: http://travelbookingscript.com/professional-bus-booking-script.html Demo: http://travelbookingscript.com/demo/professional/ Version: N/A Test...

Hotel Booking Script 1.0 SQL Injection

Exploit Title: Hotel & Tour Package Script v1.0 - SQL Injection Google Dork: N/A Date: 26.03.2017 Vendor Homepage: http://eagletechnosys.com/ Software: http://www.eaglescripts.com/hotel-booking-script Demo: http://hotelbooking.phpscriptsdemo.com/ Version: 1.0 Tested on: Win7 x64, Kali Linux x64...

Hotel Booking Script 1.0 - SQL Injection

Hotel Booking Script 1.0 - SQL Injection Exploit Title: Hotel & Tour Package Script v1.0 - SQL Injection Google Dork: N/A Date: 26.03.2017 Vendor Homepage: http://eagletechnosys.com/ Software: http://www.eaglescripts.com/hotel-booking-script Demo: http://hotelbooking.phpscriptsdemo.com/ Version:...

Tour Package Booking 1.0 - SQL Injection

Tour Package Booking 1.0 - SQL Injection Exploit Title: Tour Package Booking v1.0 - SQL Injection Google Dork: N/A Date: 26.03.2017 Vendor Homepage: http://eagletechnosys.com/ Software: www.eaglescripts.com/tour-package-booking-script Demo: http://tourbooking.phpscriptsdemo.com/ Version: 1.0 Test...