CVE-2024-46878-TikiCMS-XSS

CVE-2024-46878 - Tiki CMS Reflected Cross-Site Scripting XSS Vulnerability Tiki CMS - 'page' Parameter Reflected Cross-Site Scripting XSS Vulnerability Disclaimer Intended only for educational, research, and defensive purposes. Unauthorized use against systems without permission is illegal. Summa...

CVE-2021-39408

CVE-2021-39408 A reflected Cross Site Scripting XSS vulnerability exists in multiple version 1.0 of the Online Student Rate System application that allows for arbitrary execution of JavaScript commands. Vulnerable Page On index.php, the page parameter is vulnerable, allowing an attacker to includ...

CVE-2024-39210

CVE ID CVE-2024-39210 PRODUCT Best house rental management system VERSION =1.0 PROBLEM TYPE Incorrect Access Control Description Best House Rental Management System v1.0 was discovered to contain an arbitrary file read vulnerability via the Page parameter at index.php. This vulnerability allows...

CVE-2023-49544

CVE-2023-49544 Customer Support System 1.0 - Local File Inclusion Description : Customer Support System 1.0 is vulnerable to Local File Inclusion. An authenticated user has the capability to access and read PHP files from the operating system by exploiting a Local File Inclusion LFI vulnerability...

CVE-2026-103915

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.12 via the 'page' parameter. This makes it possible for unauthenticated attackers to extract staff personally identifiable...

EUVD-2026-114671

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.12 via the 'page' parameter. This makes it possible for unauthenticated attackers to extract staff personally identifiable...

CVE-2026-103915 Booking for Appointments and Events Calendar <= 2.4.12 - Unauthenticated Sensitive Information Exposure in 'page' Parameter

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.12 via the 'page' parameter. This makes it possible for unauthenticated attackers to extract staff personally identifiable...

CVE-2026-103915

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to and including 2.4.12 . The flaw exists within the 'page' parameter , where the raw providers array is never stripped before output. This allows unauthen...

CVE-2023-46974

CVE-2023-46974 POC Description Cross Site Scripting vulnerability in Best Courier Management System v.1.000 allows a remote attacker to execute arbitrary code via a crafted payload to the page parameter in the URL. Vulnerability Type Cross Site Scripting XSS Vendor of Product...

PT-2026-134482

Name of the Vulnerable Software and Affected Versions Booking for Appointments and Events Calendar – Amelia plugin for WordPress versions prior to 2.4.13 Description Unauthenticated attackers can extract personally identifiable information of staff members, including full names, email addresses,...

CVE-2026-103915: melograno Booking for Appointments and Events Calendar – Amelia: The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Sensitive Information…

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.12 via the 'page' parameter. This makes it possible for unauthenticated attackers to extract staff personally identifiable...

WordPress Booking for Appointments and Events Calendar – Amelia plugin <= 2.4.12 - Unauthenticated Sensitive Information Exposure in 'page' Parameter vulnerability

Unauthenticated Sensitive Information Exposure in 'page' Parameter vulnerability discovered by Kuba in WordPress Plugin Amelia versions = 2.4.12...

CVE-2023-31705

CVE-2023-31705 description A Reflected Cross-site scripting XSS vulnerability in Sourcecodester Task Reminder System 1.0 allows an authenticated user to inject malicious javascript into the page parameter. Vulnerability Type Cross Site Scripting XSS Vendor of Product Sourcecodster Affected Produc...

WordPress Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar plugin <= 5.7.8 - Authenticated (Shop Manager+) Privilege Escalation to 'page' Parameter vulnerability

Authenticated Shop Manager+ Privilege Escalation to 'page' Parameter vulnerability discovered by Wordfence PRISM in WordPress Plugin WpEvently versions = 5.7.8...

CVE-2026-109381

The Mage Eventpress plugin for WordPress is vulnerable to privilege escalation in versions up to and including 5.7.8 . The vulnerability exists in the mep_grant_shop_manager_access() function, which hooks into user_has_cap and unconditionally grants the manage_options capability. This occurs when...

CVE-2026-109381 Event Booking Manager for WooCommerce <= 5.7.8 - Authenticated (Shop Manager+) Privilege Escalation to 'page' Parameter

The Mage Eventpress plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.7.8 This is due to the mepgrantshopmanageraccess function hooking userhascap and unconditionally granting manageoptions whenever an attacker-controllable request marker matches — mos...

CVE-2026-109381 Event Booking Manager for WooCommerce <= 5.7.8 - Authenticated (Shop Manager+) Privilege Escalation to 'page' Parameter

The Mage Eventpress plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.7.8 This is due to the mepgrantshopmanageraccess function hooking userhascap and unconditionally granting manageoptions whenever an attacker-controllable request marker matches — mos...

CVE-2026-13456

The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.8 via the 'page' parameter parameter. This makes it possible for authenticated attackers, with...

CVE-2026-13456 WP Maps <= 4.9.8 - Authenticated (Subscriber+) Local File Inclusion via 'page' Parameter

The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.8 via the 'page' parameter parameter. This makes it possible for authenticated attackers, with...

CVE-2026-13456

The WP Maps WordPress plugin (versions up to and including 4.9.8 ) is vulnerable to Local File Inclusion (LFI) via the 'page' parameter . Authenticated attackers with subscriber-level access or higher can include and execute arbitrary .php files on the server. This flaw may lead to bypassing acce...