PHPJabbers Bus Reservation System 1.1 - Cross-Site Scripting

A vulnerability was found in PHP Jabbers Bus Reservation System 1.1 and classified as problematic. Affected by this issue is some unknown functionality of the file /index.php. The manipulation of the argument index/pickupid leads to cross site scripting. The attack may be launched remotely. id:...

CVE-2026-3576

CVE-2026-3576 - WordPressプラグイン Planyo Online Reservation System -f --disable-check python exploit.py http://127.0.0.1/wordpress/ -f /etc/passwd 実行例 └─$ python exploit.py http://127.0.0.1/wordpress/ -f /etc/passwd Checking if target is vulnerable... + Version found: 2.9 + Target is vulnerable...

CVE-2026-61946-Easy-Appointments-IDOR

CVE-2026-61946: 1つの予約IDで他人の予約を上書き 私は、WordPressプラグインEasy Appointmentsに、認証なしの安全でないダイレクトオブジェクト参照（IDOR）を発見しました。公開予約エンドポイントはクエリ文字列からidを受け入れ、その結果のデータをプラグインのデータベースreplaceパスに渡していました。...

Online Event Booking and Reservation System 2.3.0 - SQL Injection

Online Event Booking and Reservation System 2.3.0 contains a SQL injection vulnerability in event-management/views. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site. id:...

Joomla! Component Preventive And Reservation 1.0.5 - Local File Inclusion

A directory traversal vulnerability in the Preventive & Reservation compreventive component 1.0.5 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts via a .. dot dot in the controller parameter to index.php. id: CVE-2010-1475 info: name: Joomla...

Sourcecodester Online Event Booking and Reservation System 2.3.0 - Cross-Site Scripting

Sourcecodester Online Event Booking and Reservation System 2.3.0 contains a cross-site scripting vulnerability in PHP/MySQL via the msg parameter to /event-management/index.php. An attacker can leverage this vulnerability in order to change the visibility of the website. Once the target user clic...

CVE-2026-10290-SQLI

ホテル・観光予約システム - tour.phpにおける未認証SQLインジェクション 脆弱性の詳細 フィールド| 詳細 ---|--- タイトル| ホテル・観光予約システム - tour GETパラメータを介したSQLインジェクション ベンダー| code-projects.org ベンダーURL| https://code-projects.org/hotel-and-tourism-reservation-in-php-with-source-code/ 製品| ホテル・観光予約システム バージョン| 1.0 脆弱性タイプ| SQLインジェクション CWE| CWE-89 CVSSスコ...

CVE-2021-41511

CVE-2021-41511 漏洞标题: 住宿预订管理系统 1.0 - SQL注入/认证绕过 漏洞作者: Nitin Sharmavidvansh 厂商主页: https://www.sourcecodester.com/php/14883/lodging-reservation-management-system-php-free-source-code.html 软件链接:...

CVE-2025-7840

CVE-2025-7840 用 XSS エクスプロイト 作者 : Byte Reaper @ByteReaper0 説明 CVE-2025-7840 の概念実証エクスプロイト。予約フォームの Firstname パラメータにおけるユーザー入力のサニタイズが不十分な脆弱な Web アプリケーションエンドポイントを標的としています。次のような GET リクエストを作成することで: /index.php?page=reserve&Firstname=&Lastname=test 攻撃者はレスポンスがレンダリングされた際に被害者のブラウザで任意の JavaScript を注入・実行できます。 機...

vLLM: Request-selected PyNvVideoCodec GPU decode bypasses static VRAM reservation

SummaryCurrent vLLM main lets an inference request choose the PyNvVideoCodec GPU video decoder through mediaiokwargs.video.videobackend, but engine GPU memory reservation is computed only from static startup configuration and VLLMVIDEOLOADERBACKEND. If the server starts with the default...

CVE-2026-97251

Unauthenticated Insecure Direct Object References IDOR in Bus Ticket Booking with Seat Reservation = 5.9.3 versions...

EUVD-2026-90856

Unauthenticated Insecure Direct Object References IDOR in Bus Ticket Booking with Seat Reservation = 5.9.3 versions...

CVE-2026-97251 WordPress Bus Ticket Booking with Seat Reservation plugin <= 5.9.3 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in Bus Ticket Booking with Seat Reservation = 5.9.3 versions...

CVE-2026-97251

The Bus Ticket Booking with Seat Reservation plugin for WordPress versions

EUVD-2026-90435

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office Hotel Reservation System Book Now search, where dateto and idroomtype parameters are copied into template variables without validation. Attackers can craft a malicious link containing JavaScript paylo...

CVE-2026-103587

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office Hotel Reservation System Book Now search, where dateto and idroomtype parameters are copied into template variables without validation. Attackers can craft a malicious link containing JavaScript paylo...

CVE-2026-103587 QloApps through 1.7.0 Reflected XSS via Book Now Search Parameters

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office Hotel Reservation System Book Now search, where dateto and idroomtype parameters are copied into template variables without validation. Attackers can craft a malicious link containing JavaScript paylo...

CVE-2026-103587 QloApps through 1.7.0 Reflected XSS via Book Now Search Parameters

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office Hotel Reservation System Book Now search, where dateto and idroomtype parameters are copied into template variables without validation. Attackers can craft a malicious link containing JavaScript paylo...

CVE-2026-103587

QloApps versions through 1.7.0 are vulnerable to a reflected cross-site scripting (XSS) flaw within the back-office Hotel Reservation System Book Now search functionality. The vulnerability occurs because the date_to and id_room_type parameters are copied into template variables without sufficien...

CVE-2026-103587 QloApps through 1.7.0 Reflected XSS via Book Now Search Parameters

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office Hotel Reservation System Book Now search, where dateto and idroomtype parameters are copied into template variables without validation. Attackers can craft a malicious link containing JavaScript paylo...