CVE-2023-49544

CVE-2023-49544 Customer Support System 1.0 - Inclusión de Archivos Locales Description : El Customer Support System 1.0 es vulnerable a la Inclusión de Archivos Locales. Un usuario autenticado tiene la capacidad de acceder y leer archivos PHP del sistema operativo explotando una vulnerabilidad de...

CVE-2023-49973

CVE-2023-49973 Customer Support System 1.0 - Cross-Site Scripting XSS Vulnerability in "email" field/parameter on "customerlist" Page Description : Customer Support System 1.0 is vulnerable to stored XSS. A XSS vulnerability exists in version 1 of the Customer Support System. A malicious actor ca...

CVE-2023-51281

CVE-2023-51281 Customer Support System 1.0 - Vulnerabilidad de Cross-Site Scripting XSS Múltiple en los parámetros “firstname”, "lastname", "middlename", "contact" o “address” Descripción : Múltiples vulnerabilidades de Cross-Site Scripting XSS en /customersupport/ajax.php?action=savecustomer en...

WPBookit <= 1.0.8 - Unauthenticated Customer Information Disclosure

WPBookit WordPress plugin = 1.0.8 contains an information disclosure vulnerability caused by missing authorization check on 'getcustomerlist' route, letting unauthenticated attackers retrieve sensitive customer data. id: CVE-2026-1980 info: name: WPBookit = 1.0.8 - Unauthenticated Customer...

CVE-2023-46478

CVE-2023-46478 Minical 1.0.0 is vulnerable to IDOR . Vendor: https://github.com/minical/minical Demo Application: https://demo.minical.io/ PoC Step 1: I have created two user accounts user A hacker then user B walker-448 Step 2: Go to the User B account then Navigate to the Accounting module and...

CVE-2023-49974

CVE-2023-49974 Customer Support System 1.0 - Cross-Site Scripting XSS Vulnerability in "contact" field/parameter on "customerlist" Page Description : Customer Support System 1.0 is vulnerable to stored XSS. A XSS vulnerability exists in version 1 of the Customer Support System. A malicious actor...

CVE-2023-49977

CVE-2023-49977 Customer Support System 1.0 - Cross-Site Scripting XSS Vulnerability in "Address" field/parameter on "customerlist" Page Description : Customer Support System 1.0 is vulnerable to stored XSS. A XSS vulnerability exists in version 1 of the Customer Support System. A malicious actor...

CVE-2023-49547

CVE-2023-49547 Customer Support System 1.0 - SQL Injection Login Bypass Description : Customer Support System is vulnerable 1.0 to SQL Injection. A SQL injection vulnerability in Customer Support System 1.0 enables remote, unauthenticated attackers to bypass the authentication process by exploiti...

CVE-2023-49546

CVE-2023-49546 Customer Support System 1.0 - SQL Injection Vulnerability in the "email" Parameter During "savestaff" Operation Description : A SQL Injection vulnerability exists in version 1 of the Customer Support System. A malicious attacker can issue SQL commands to the MySQL database when...

CVE-2023-49968

CVE-2023-49968 Customer Support System 1.0 - Vulnerabilidad de Inyección SQL en managedepartment.php a través del parámetro URL 'id' Description : Existe una vulnerabilidad de Inyección SQL en la versión 1 del Customer Support System. Un atacante con intenciones maliciosas puede ejecutar comandos...

CVE-2023-50071

CVE-2023-50071 Customer Support System 1.0 - Múltiples vulnerabilidades de inyección SQL - savedepartment Descripción : Múltiples vulnerabilidades de inyección SQL en /customersupport/ajax.php?action=savedepartment en Customer Support System 1.0 permiten a atacantes autenticados ejecutar comandos...

CVE-2023-49976

CVE-2023-49976 Customer Support System 1.0 - XSS Cross-Site Scripting Vulnerability in the "subject" at "ticketlist" Description : Customer Support System 1.0 is vulnerable to stored XSS. A XSS vulnerability exists in version 1 of the Customer Support System. A malicious actor can insert JavaScri...

CVE-2023-49970

CVE-2023-49970 Customer Support System 1.0 - Vulnerabilidad de Inyección SQL en el parámetro "subject" durante la operación "saveticket" Descripción : Existe una vulnerabilidad de Inyección SQL en la versión 1 del Customer Support System. Un atacante malicioso puede ejecutar comandos SQL en la ba...

CVE-2023-49548

CVE-2023-49548 Customer Support System 1.0 - SQL Injection Vulnerability in the "lastname" Parameter During "saveuser" Operation Description : A SQL Injection vulnerability exists in version 1 of the Customer Support System. A malicious attacker can issue SQL commands to the MySQL database when...

CVE-2023-49545

CVE-2023-49545 Customer Support System 1.0 - Listado de Directorios Descripción : Una vulnerabilidad de listado de directorios en Customer Support System v1 permite a los atacantes listar directorios y archivos sensibles dentro de la aplicación sin requerir autenticación/autorización. Versión del...

CVE-2023-49978

CVE-2023-49978 Customer Support System 1.0 - Control de Acceso Incorrecto Descripción : El control de acceso incorrecto en Customer Support System v1 permite que usuarios no administradores accedan a páginas administrativas y ejecuten acciones reservadas para administradores. Versión del Producto...

CVE-2023-49969

CVE-2023-49969 Customer Support System 1.0 - 通过“id” URL参数在 editcustomer 中的 SQL 注入漏洞 描述 ：Customer Support System 版本 1 存在 SQL 注入漏洞。具有恶意意图的攻击者可以在编辑客户时，通过操纵 'id' URL 参数来对 MySQL 数据库执行 SQL 命令。 受影响的产品版本 ：Customer Support System 1.0 CVE 作者 ：Geraldo Alcântara 日期 ：2023年11月28日 确认时间 ：2023年12月19日 CVE...

CVE-2026-88995

The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.1 does not properly restrict the data returned by an availability-check request, allowing unauthenticated users to retrieve other customers' appointment details, including free-text booking comments and contact information...

CVE-2023-49971

CVE-2023-49971 客户支持系统 1.0 - 在"customerlist"页面的"firstname"字段/参数中存在跨站脚本XSS漏洞 描述 ：客户支持系统 1.0 存在存储型 XSS 漏洞。该漏洞存在于客户支持系统 1 版本中。恶意攻击者可以在编辑/创建客户时，通过"firstname"字段/参数插入 JavaScript 代码。每当访问页面 "/customersupport/index.php?page=customerlist" 时，该代码就会被执行。 受影响产品版本 ：客户支持系统 1.0 CVE 作者 ：Geraldo Alcântara 日期...

CVE-2023-50070

CVE-2023-50070 Customer Support System 1.0 - Múltiples vulnerabilidades de inyección SQL - saveticket Descripción : Múltiples vulnerabilidades de inyección SQL en /customersupport/ajax.php?action=saveticket en Customer Support System 1.0 permiten a atacantes autenticados ejecutar comandos SQL...