PT-2023-19428

Name of the Vulnerable Software and Affected Versions The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress versions up to, and including, 4.4.6 Description The issue is related to a missing capability check on the vcita save settings callback function. This allows...

PT-2023-17386

Name of the Vulnerable Software and Affected Versions ShiftController Employee Shift Scheduling plugin for WordPress versions up to, and including, 4.9.25 Description The issue is related to Reflected Cross-Site Scripting via the query string due to insufficient input sanitization and output...

WordPress Online Booking & Scheduling Calendar for WordPress by vcita Plugin < 4.3.2 is vulnerable to Cross Site Scripting (XSS)

Software Online Booking & Scheduling Calendar for WordPress by vcita Type Plugin Vulnerable versions 4.3.2 Fixed in 4.3.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-2298 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID...

WordPress Online Booking & Scheduling Calendar for WordPress by vcita Plugin <= 4.4.2 is vulnerable to Arbitrary File Upload

Software Online Booking & Scheduling Calendar for WordPress by vcita Type Plugin Vulnerable versions = 4.4.2 Fixed in N/A OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2023-2414 Patch priority High CVSS severity High 9.9 Developer Claim ownership PSID 69648001908f Credit...

CVE-2023-2415

The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vcitalogoutcallback function in versions up to, and including, 4.2.10. This makes it possible for authenticated attacker...

Design/Logic Flaw

The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized medication of data via the /wp-json/vcita-wordpress/v1/actions/auth REST-API endpoint in versions up to, and including, 4.2.10 due to a missing capability check on the processAction...

CVE-2023-2298

CVE-2023-2298 refers to a Stored Cross-Site Scripting vulnerability in the WordPress plugin Online Booking & Scheduling Calendar for WordPress by vcita . Versions up to and including 4.2.10 are affected due to insufficient input sanitization and output escaping of the business_id parameter, allow...

CVE-2023-2299

CVE-2023-2299 affects the Online Booking & Scheduling Calendar for WordPress by vcita plugin. The issue is an unauthorized data modification vulnerability via the REST-API endpoint /wp-json/vcita-wordpress/v1/actions/auth, caused by a missing capability check in the processAction function. It aff...

WordPress Plugin Online Booking & Scheduling Calendar Cross-Site Request Forgery Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

CVE-2023-2416: Cross-Site Request Forgery (CSRF)

The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the vcitalogoutcallback function in versions up to, and including, 4.5. This makes it possible for unauthenticated to logout a vctia...

CVE-2023-2298: Improper Neutralization of Input During Web Page Generation

The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'businessid' parameter in versions up to, and including, 4.3.0 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2023-2415: Missing Authorization

The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vcitalogoutcallback function in versions up to, and including, 4.2.10. This makes it possible for authenticated attacker...

CVE-2023-2299: Missing Authorization

The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized medication of data via the /wp-json/vcita-wordpress/v1/actions/auth REST-API endpoint in versions up to, and including, 4.4.2 due to a missing capability check on the processAction...

Online Booking & Scheduling Calendar for WordPress by vcita < 4.3.1 - Unauthenticated Stored Cross-Site Scripting

The plugin does not sanitize and escape the businessid parameter of an unprotected REST route endpoint before rendering it back in pages on the website, allowing an unauthenticated attacker to inject arbitrary web scripts, which could target authenticated users such as administrators. curl...

Online Booking & Scheduling Calendar for WordPress by vcita <= 4.3.3 - Missing authentication

The plugin does not validate authorization in its vcita-wordpress/v1/actions/auth REST route endpoint, allowing an unauthenticated attacker to set the connection parameters for the vcita account connection, including businessname and email address. Furthermore, the variables are stored in the...

Online Booking & Scheduling Calendar for WordPress by vcita < 4.3.0 - Subscriber+ Denial of Service by account logout

The plugin does not validate authorization in the vcitalogout ajax action, allowing any logged in user with roles as low as subscriber to log the site out from the cvita account, causing a denial of service for the appointment scheduling functionality...

Online Booking & Scheduling Calendar for WordPress by vcita <= 4.3.3 - Missing authentication

The plugin does not validate authorization in its vcita-wordpress/v1/actions/auth REST route endpoint, allowing an unauthenticated attacker to set the connection parameters for the vcita account connection, including businessname and email address. Furthermore, the variables are stored in the...

Class Scheduling System Cross-Site Scripting Vulnerability

Class Scheduling System is a class scheduling system. A cross-site scripting vulnerability exists in Class Scheduling System v1.0, which originates from the lack of effective filtering and escaping of user-supplied data in the AcademicRank parameter of the file /admin/saveteacher.php in the...

CVE-2023-2826

A vulnerability has been found in SourceCodester Class Scheduling System 1.0 and classified as problematic. This vulnerability affects unknown code of the file searchteacherresult.php of the component POST Parameter Handler. The manipulation of the argument teacher leads to cross site scripting...

CVE-2023-2826

A vulnerability has been found in SourceCodester Class Scheduling System 1.0 and classified as problematic. This vulnerability affects unknown code of the file searchteacherresult.php of the component POST Parameter Handler. The manipulation of the argument teacher leads to cross site scripting...