229 matches found
CVE-2024-2441
CVE-2024-2441 (VikBooking plugin) : The VikBooking Hotel Booking Engine & PMS for WordPress (before 1.6.8) suffers an insecure direct object reference (IDOR) flaw in its access control, allowing an authenticated user with subscriber privileges or higher to directly access menus and plugin setting...
The vulnerability of the PMS module of the EMUI operating system of HarmonyOS allows a hacker to elevate their privileges.
The vulnerability of the PMS module of the EMUI operating system of HarmonyOS is related to incorrect default permissions. Exploiting this vulnerability can allow a remote attacker to increase their privileges within the system...
CVE-2024-32563 WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.6.7 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in VikBooking Hotel Booking Engine & PMS allows Reflected XSS.This issue affects VikBooking Hotel Booking Engine & PMS: from n/a through 1.6.7...
CVE-2024-32563 WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.6.7 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in VikBooking Hotel Booking Engine & PMS allows Reflected XSS.This issue affects VikBooking Hotel Booking Engine & PMS: from n/a through 1.6.7...
WordPress VikBooking Hotel Booking Engine & PMS Plugin <= 1.6.7 is vulnerable to Cross Site Scripting (XSS)
Software VikBooking Hotel Booking Engine & PMS Type Plugin Vulnerable versions = 1.6.7 Fixed in 1.6.8 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-32563 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID ef5a73c65f96 Credits Majed Refa...
CVE-2024-20767 - Adobe Coldfusion Arbitrary File Read
This module exploits an Improper Access Vulnerability in Adobe Coldfusion versions prior to version '2023 Update 6' and '2021 Update 12'. The vulnerability allows unauthenticated attackers to request authentication token in the form of a UUID from the /CFIDE/adminapi/servermanager/servermanager.c...
CVE-2024-24817 User can see invitees in events created in PMs and private categories
Discourse Calendar adds the ability to create a dynamic calendar in the first post of a topic on the open-source discussion platform Discourse. Prior to version 0.4, event invitees created in topics in private categories or PMs private messages can be retrieved by anyone, even if they're not logg...
CVE-2024-1389 Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.11.1 - Missing Authorization via pms_stripe_connect_handle_authorization_return
The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pmsstripeconnecthandleauthorizationreturn function in all versions up to, and...
PT-2024-18001 · WordPress · Paid Membership Subscriptions
Name of the Vulnerable Software and Affected Versions: Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress versions up to, and including, 2.11.1 Description: The issue allows unauthorized modification of data due to a missing...
CVE-2023-46773
Permission management vulnerability in the PMS module. Successful exploitation of this vulnerability may cause privilege escalation...
CVE-2023-46773
Technical details for CVE-2023-46773 are not publicly available in the provided documents. Monitor for updates.
CVE-2023-46773
Permission management vulnerability in the PMS module. Successful exploitation of this vulnerability may cause privilege escalation...
CVE-2023-6439
A vulnerability classified as problematic was found in ZenTao PMS 18.8. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated...
Cross site scripting
A vulnerability classified as problematic was found in ZenTao PMS 18.8. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated...
CVE-2023-6439 ZenTao PMS cross site scripting
A vulnerability classified as problematic was found in ZenTao PMS 18.8. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated...
CVE-2023-6439
CVE-2023-6439 affects ZenTao PMS 18.8. The vulnerability is described as a cross-site scripting in an unknown functionality of the product, with remote exploitation and a publicly disclosed exploit. Multiple sources reiterate the issue but do not provide concrete technical details about the vulne...
CVE-2023-6439 ZenTao PMS cross site scripting
A vulnerability classified as problematic was found in ZenTao PMS 18.8. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated...
PT-2023-32667 · Zentaopms · Zentaopms
Name of the Vulnerable Software and Affected Versions: ZenTao PMS version 18.8 Description: A problematic vulnerability was found in the software, affecting an unknown functionality, which leads to cross-site scripting. The attack can be launched remotely. The exploit has been disclosed to the...