492 matches found
Sql injection
SQL injection vulnerability in Booking Calendar plugin 8.4.3 for WordPress allows remote attackers to execute arbitrary SQL commands via the bookingid parameter...
MyBB Upcoming Events 1.32 Cross Site Scripting
Exploit Title: MyBB Upcoming Events Plugin 1.32 - Cross-Site Scripting Date: 3/8/2019 Author: 0xB9 Twitter: @0xB9Sec Contact: 0xB9atpm.me Software Link: https://community.mybb.com/mods.php?action=view&pid=1231 Version: 1.32 Tested on: Ubuntu 18.04 CVE: CVE-2019-9650 1. Description: This plugin...
CVE-2018-20556
CVE-2018-20556 is a SQL injection vulnerability in the WordPress plugin Booking Calendar (version 8.4.3). The flaw allows an attacker to manipulate the booking_id parameter to execute arbitrary SQL commands on the underlying database, potentially exposing data. Multiple connected sources corrobor...
CVE-2018-20556
SQL injection vulnerability in Booking Calendar plugin 8.4.3 for WordPress allows remote attackers to execute arbitrary SQL commands via the bookingid parameter...
WordPress Calendar plugin <= 1.3.10 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated Stored Cross-Site Scripting XSS vulnerability found by boombyte in WordPress Calendar plugin versions = 1.3.10. Solution WordPress Calendar plugin was closed on 2018 November 2 and is no longer available for download. Please deactivate and uninstall plugin as soon as possible...
WordPress booking-calendar plugin has unspecified vulnerability
WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports PHP and MySQL servers to set up a personal blog site. booking-calendar plugin is used in one of the online booking plugin. A security vulnerability exists in WordPress...
CVE-2018-10363
An issue was discovered in the WpDevArt "Booking calendar, Appointment Booking System" plugin 2.2.2 for WordPress. Multiple parameters allow remote attackers to manipulate the values to change data such as prices...
Visual Calendar SQL Injection Vulnerability in Joomla!
Joomla! is the U.S. Open Source Matters team using PHP and MySQL development of a set of open source , cross-platform content management system CMS. Visual Calendar is one of the visual calendar plug-in . A SQL injection vulnerability exists in Joomla! Visual Calendar version 3.1.3. A remote...
WordPress booking-calendar plugin cross-site request forgery vulnerability
WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports PHP and MySQL servers to set up a personal blog site. booking-calendar plugin is used in one of the online booking plugin. A cross-site request forgery vulnerability...
WordPress booking-calendar plugin cross-site scripting vulnerability
WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports PHP and MySQL servers to set up a personal blog site. booking-calendar plugin is used in one of the online booking plugin. A cross-site scripting vulnerability exists ...
CVE-2018-5672
An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php formfield5label parameter...
CVE-2018-5673
An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. CSRF exists via wp-admin/admin.php...
CVE-2018-5671
An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php extrafield1itemsfielditem1pricepercent parameter...
CVE-2018-5670
An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php saleconditionscount parameter...
Design/Logic Flaw
An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php extrafield1itemsfielditem1pricepercent parameter...
CVE-2018-5673
The CVE-2018-5673 entry concerns the WordPress Booking Calendar plugin prior to v2.1.8, where a CSRF vulnerability exists in wp-admin/admin.php for plugin 2.1.7. The NVD entry records CSRF with CVSS v2 base 6.8 (Medium) and CVSS v3 base 8.8 (High). Connected sources also describe an authenticated...
CVE-2018-5315
The Wachipi WP Events Calendar plugin 1.0 for WordPress has SQL Injection via the eventid parameter to event.php...
CVE-2018-5315
The Wachipi WP Events Calendar plugin 1.0 for WordPress has SQL Injection via the eventid parameter to event.php...
WordPress Wichipi Events Calendar Plugin SQL Injection Vulnerability
WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports PHP and MySQL servers to set up a personal blog site.Wachipi WP Events Calendar plugin is used in one of the task calendar plugin. A SQL injection vulnerability exists...