WordPress WP Travel Engine plugin <= 6.8.4 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'booking_id' Parameter vulnerability

Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'bookingid' Parameter vulnerability discovered by Supakiad S. m3ez - E-CQURITY Thailand in WordPress Plugin WP Travel Engine versions = 6.8.4...

CVE-2026-17087 WP Travel Engine <= 6.8.4 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'booking_id' Parameter

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-17087 WP Travel Engine <= 6.8.4 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'booking_id' Parameter

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

EUVD-2022-41089

Malicious code in bioql PyPI...

CVE-2023-0570: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability, which was classified as critical, was found in SourceCodester Online Tours & Travels Management System 1.0. This affects an unknown part of the file user\operations\paymentoperation.php. The manipulation of the argument bookingid leads to sql injection. It is possible to initiate...

CVE-2022-38509

Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the bookingid parameter at /admin/budget.php...

Sql injection

Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the bookingid parameter at /admin/budget.php...

CVE-2022-38509

Wedding Planner v1.0 contains a SQL injection flaw in the booking_id parameter of /admin/budget.php. Affected component: the web application’s admin budget handling. Root cause: improper input handling allowing SQL injection. Impact per CVSSv3.1: high confidentiality, integrity, and availability ...

CVE-2022-38509

Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the bookingid parameter at /admin/budget.php...

CVE-2022-38509: Improper Neutralization of Special Elements used in an SQL Command

Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the bookingid parameter at /admin/budget.php...

CVE-2022-30834: Improper Neutralization of Special Elements used in an SQL Command

Wedding Management System v1.0 is vulnerable to SQL Injection via /Wedding-Management/admin/clientmanageaccountdetails.php?bookingid=31&userid=...

CVE-2022-30835: Improper Neutralization of Special Elements used in an SQL Command

Wedding Management System v1.0 is vulnerable to SQL Injection. via /Wedding-Management/admin/budget.php?bookingid=...

CVE-2018-20556

CVE-2018-20556 is a SQL injection vulnerability in the WordPress plugin Booking Calendar (version 8.4.3). The flaw allows an attacker to manipulate the booking_id parameter to execute arbitrary SQL commands on the underlying database, potentially exposing data. Multiple connected sources corrobor...

CVE-2018-20556: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Booking Calendar plugin 8.4.3 for WordPress allows remote attackers to execute arbitrary SQL commands via the bookingid parameter...