CVE-2022-44401

Online Tours & Travels Management System v1.0 contains an arbitrary file upload vulnerability via /tour/admin/file.php...

CVE-2022-43061

Online Tours & Travels Management System v1.0 was discovered to contain an arbitrary file upload vulnerability in the component /operations/travellers.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file...

CVE-2022-43050

Online Tours & Travels Management System v1.0 was discovered to contain an arbitrary file upload vulnerability in the component updateprofile.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file...

CVE-2022-42142

Online Tours & Travels Management System v1.0 is vulnerable to Arbitrary code execution via ip/tour/admin/operations/updatesettings.php...

CVE-2022-41416

Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /user/updatebooking.php...

CVE-2022-40093

Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /tour/admin/updatetax.php...

CVE-2022-40098

Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/updateexpense.php...

CVE-2022-41537

Online Tours & Travels Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /useroperations/profile.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file...

CVE-2022-40352

Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/updatetraveller.php...

CVE-2022-40092

Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /tour/admin/updatepayment.php...

CVE-2022-40099

Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/updateexpensecategory.php...

CVE-2022-32992

Online Tours And Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the tname parameter at /admin/operations/tax.php...

CVE-2025-31921

Cross-Site Request Forgery CSRF vulnerability in loopus WP Ultimate Tours Builder WPUltimateToursBuilder allows Cross Site Request Forgery.This issue affects WP Ultimate Tours Builder: from n/a through = 1.055...

CVE-2024-51666

Missing Authorization vulnerability in Tosin Oguntuyi Tours tours.This issue affects Tours: from n/a through = 1.0.0...

CVE-2025-31921

Cross-Site Request Forgery CSRF vulnerability in loopus WP Ultimate Tours Builder WPUltimateToursBuilder allows Cross Site Request Forgery.This issue affects WP Ultimate Tours Builder: from n/a through = 1.055...

CVE-2025-31921 WordPress WP Ultimate Tours Builder plugin <= 1.055 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in loopus WP Ultimate Tours Builder WPUltimateToursBuilder allows Cross Site Request Forgery.This issue affects WP Ultimate Tours Builder: from n/a through = 1.055...

CVE-2025-31921 WordPress WP Ultimate Tours Builder <= 1.055 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in loopus WP Ultimate Tours Builder allows Cross Site Request Forgery. This issue affects WP Ultimate Tours Builder: from n/a through 1.055...

CVE-2025-31921

CVE-2025-31921: CSRF vulnerability in WordPress WP Ultimate Tours Builder (versions &lt;= 1.055). Affects loopus WP Ultimate Tours Builder; CVSS v3.1 base score 4.3 (Medium). Root cause is CSRF allowing unauthorized actions on behalf of an authenticated user. Connected sources consistently refere...

WordPress plugin WP Ultimate Tours Builder 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site reques...

PT-2025-21679 · WordPress · Wp Ultimate Tours Builder

Name of the Vulnerable Software and Affected Versions: WP Ultimate Tours Builder versions 1.055 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the loopus WP Ultimate Tours Builder, allowing unauthorized actions to be performed on behalf of a user. This is a type of attac...