Booking Project Security Vulnerabilities

CVE-2022-29992

Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via...

CVE-2022-29994

Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via...

CVE-2022-29995

Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via...

CVE-2022-29985

Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via...

CVE-2022-29988

Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via...

CVE-2022-29990

Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via...

CVE-2022-29993

Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via...

CVE-2022-1463

The Booking Calendar plugin for WordPress is vulnerable to PHP Object Injection via the [bookingflextimeline] shortcode in versions up to, and including, 9.1. This could be exploited by subscriber-level users and above to call arbitrary PHP objects on a vulnerable...

CVE-2022-28093

SCBS Online Sports Venue Reservation System v1.0 was discovered to contain a local file inclusion vulnerability which allow attackers to execute arbitrary code via a crafted PHP...

CVE-2022-28094

SCBS Online Sports Venue Reservation System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the fid parameter at...

CVE-2022-28115

Online Sports Complex Booking v1.0 was discovered to contain a SQL injection vulnerability via the id...

CVE-2021-45003

Laundry Booking Management System 1.0 (Latest) and previous versions are affected by a remote code execution (RCE) vulnerability in profile.php through the "image" parameter that can execute a webshell...

CVE-2021-25040

The Booking Calendar WordPress plugin before 8.9.2 does not sanitise and escape the booking_type parameter before outputting it back in an admin page, leading to a Reflected Cross-Site...

CVE-2021-42667

A SQL Injection vulnerability exists in Sourcecodester Online Event Booking and Reservation System in PHP in event-management/views. An attacker can leverage this vulnerability in order to manipulate the sql query performed. As a result he can extract sensitive data from the web server and in some....

CVE-2021-42663

An HTML injection vulnerability exists in Sourcecodester Online Event Booking and Reservation System in PHP/MySQL via the msg parameter to /event-management/index.php. An attacker can leverage this vulnerability in order to change the visibility of the website. Once the target user clicks on a...

CVE-2021-42662

A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Online Event Booking and Reservation System in PHP/MySQL via the Holiday reason parameter. An attacker can leverage this vulnerability in order to run javascript commands on the web server surfers behalf, which can lead to.....

CVE-2020-21012

Sourcecodester Hotel and Lodge Management System 2.0 is vulnerable to unauthenticated SQL injection and can allow remote attackers to execute arbitrary SQL commands via the email parameter to the edit page for Customer, Room, Currency, Room Booking Details, or Tax...

CVE-2020-25889

Online Bus Booking System Project Using PHP/MySQL version 1.0 has SQL injection via the login page. By placing SQL injection payload on the login page attackers can bypass the authentication and can gain the admin...

CVE-2020-29283

An SQL injection vulnerability was discovered in Online Doctor Appointment Booking System PHP and Mysql via the q parameter to...

CVE-2020-25273

In SourceCodester Online Bus Booking System 1.0, there is Authentication bypass on the Admin Login screen in admin.php via username or password SQL...

CVE-2020-25272

In SourceCodester Online Bus Booking System 1.0, there is XSS through the name parameter in...

CVE-2020-23984

Online Hotel Booking System Pro PHP Version 1.3 has Persistent Cross-site Scripting in Customer registration-form...

CVE-2020-15536

An issue was discovered in the bestsoftinc Hotel Booking System Pro plugin through 1.1 for WordPress. Persistent XSS can occur via any of the registration...

CVE-2019-15774

The nd-booking plugin before 2.5 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl...

CVE-2019-7554

An issue was discovered in PHP Scripts Mall API Based Travel Booking 3.4.7. There is Reflected XSS via the flight-results.php d2...

CVE-2018-20556

SQL injection vulnerability in Booking Calendar plugin 8.4.3 for WordPress allows remote attackers to execute arbitrary SQL commands via the booking_id...

CVE-2019-9064

PHP Scripts Mall Cab Booking Script 1.0.3 allows Directory Traversal into the parent directory of a jpg or png...

CVE-2019-9066

PHP Scripts Mall PHP Appointment Booking Script 3.0.3 allows HTML injection in a user...

CVE-2018-15190

PHP Scripts Mall hotel-booking-script 2.0.4 allows XSS via the First Name, Last Name, or Address...

CVE-2018-15191

PHP Scripts Mall hotel-booking-script 2.0.4 allows remote attackers to cause a denial of service via crafted JavaScript code in the First Name, Last Name, or Address...

CVE-2018-5672

An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php form_field5[label]...

CVE-2018-5671

An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php extra_field1[items][field_item1][price_percent]...

CVE-2018-5673

An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. CSRF exists via...

CVE-2018-5670

An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php sale_conditions[count][]...

CVE-2017-17633

Multiplex Movie Theater Booking Script 3.1.5 has SQL Injection via the trailer-detail.php moid parameter, show-time.php moid parameter, or event-detail.php eid...

CVE-2017-17632

Responsive Events And Movie Ticket Booking Script 3.2.1 has SQL Injection via the findcity.php q...

CVE-2017-17619

Laundry Booking Script 1.0 has SQL Injection via the /list city...

CVE-2017-17634

Single Theater Booking Script 3.2.1 has SQL Injection via the findcity.php q...

CVE-2017-17609

Chartered Accountant Booking Script 1.0 has SQL Injection via the /service-list city...

CVE-2017-17604

Entrepreneur Bus Booking Script 3.0.4 has SQL Injection via the booker_details.php sourcebus...

CVE-2017-17595

Beauty Parlour Booking Script 1.0 has SQL Injection via the /list gender or city...

CVE-2017-17601

Cab Booking Script 1.0 has SQL Injection via the /service-list city...

CVE-2017-2150

Directory traversal vulnerability in Booking Calendar version 7.0 and earlier allows remote attackers to read arbitrary files via specially crafted captcha_chalange...

CVE-2017-2151

Cross-site scripting vulnerability in Booking Calendar version 7.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified...

CVE-2015-1000009

Open proxy in Wordpress plugin google-adsense-and-hotel-booking...