Design/Logic Flaw

An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php saleconditionscount parameter...

Cross site request forgery (csrf)

An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. CSRF exists via wp-admin/admin.php...

Design/Logic Flaw

An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php formfield5label parameter...

Design/Logic Flaw

An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php extrafield1itemsfielditem1pricepercent parameter...

CVE-2018-5670

An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php saleconditionscount parameter...

CVE-2018-5671

An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php extrafield1itemsfielditem1pricepercent parameter...

CVE-2018-5670

CVE-2018-5670 affects the WordPress booking-calendar plugin up to version 2.1.7. The issue is an XSS in wp-admin/admin.php via the sale_conditions[count][] parameter, as reported across sources (NVD, CNVD, CVE listings). Some records describe this as an authenticated stored XSS with CSRF (WPVulnd...

CVE-2018-5673

An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. CSRF exists via wp-admin/admin.php...

CVE-2018-5672

CVE-2018-5672 affects the WordPress booking-calendar plugin, version 2.1.7. It exposes a stored XSS via the wp-admin/admin.php form_field5[label] parameter, as described across CNVD/NVD entries. Exploitation could allow an attacker to obtain a user cookie or perform a malicious action; the inform...

CVE-2018-5671

CVE-2018-5671 affects the WordPress plugin booking-calendar 2.1.7 . The issue is a stored XSS vulnerability exploitable via the request parameter wp-admin/admin.php?extra_field1[items][field_item1][price_percent] . The available sources describe the vulnerability path but do not provide specific ...

CVE-2018-5673

The CVE-2018-5673 entry concerns the WordPress Booking Calendar plugin prior to v2.1.8, where a CSRF vulnerability exists in wp-admin/admin.php for plugin 2.1.7. The NVD entry records CSRF with CVSS v2 base 6.8 (Medium) and CVSS v3 base 8.8 (High). Connected sources also describe an authenticated...

CVE-2018-5670

An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php saleconditionscount parameter...

CVE-2018-5672

An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php formfield5label parameter...

Booking Calendar <= 2.1.7 - Authenticated Stored XSS & CSRF

The Booking calendar, Appointment Booking System WordPress plugin was affected by an Authenticated Stored XSS & CSRF security vulnerability...

Taxi Booking Script 1.0 - Cross-site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: Taxi Booking Script v1.0 - Cross-site Scripting XSS Vendor Homepage: https://www.phpjabbers.com/taxi-booking-script/ Software Link: Demo:...

Taxi Booking Script 1.0 - Cross-site Scripting

Exploit Title: Taxi Booking Script v1.0 - Cross-site Scripting XSS Date: 11.01.2018 Vendor Homepage: https://www.phpjabbers.com/taxi-booking-script/ Software Link: Demo: http://demo.phpjabbers.com/1515648238792/index.php?controller=pjAdminUsers&action=pjActionIndex&err=AU01 Version: 1.0 Category:...

Service Finder Booking < 3.2 - Unauthenticated Local File Disclosure

The premium Service Finder Booking WordPress plugin was vulnerable to a Local File Disclosure vulnerability that could allow unauthenticated users to include arbitrary files on the server. http://victim.com/wp-content/plugins/sf-booking/lib/downloads.php?file=/index.php...

Service Finder Booking < 3.2 - Unauthenticated Local File Disclosure

The premium Service Finder Booking WordPress plugin was vulnerable to a Local File Disclosure vulnerability that could allow unauthenticated users to include arbitrary files on the server. PoC http://victim.com/wp-content/plugins/sf-booking/lib/downloads.php?file=/index.php...

WordPress Service Finder Booking File Disclosure

File disclosure vulnerability in Service Finder Booking plugin Vulnerability Type: File Disclosure For the exploit source code contact DSquare Security sales team...

Worpress Service Finder Booking < 3.2 Plugin - Local File Disclosure Vulnerability

Exploit for php platform in category web applications Exploit Title: Worpress Plugin Service Finder Booking 3.2 - Local File Disclosure Google Dork: N/A Date: 09/01/2018 GMT+7 Exploit Author: telahdihapus Vendor Homepage: https://themeforest.net/user/aonetheme Software Link:...