CVE-2024-42769

A Reflected Cross Site Scripting (XSS) vulnerability exists in the Kashipara Hotel Management System v1.0 within the /core/signup_user.php endpoint. The root cause is a lack of effective filtering and escaping of user-supplied data in the user_fname and user_lname parameters. Remote attackers can...

CVE-2024-42772

An Incorrect Access Control vulnerability exists in the Kashipara Hotel Management System v1.0 within the /admin/rooms.php endpoint. This flaw allows an unauthenticated attacker to access the administrator section and view valid hotel room entries , potentially exposing sensitive information. As ...

CVE-2024-42771

The Kashipara Hotel Management System v1.0 is affected by a Stored Cross Site Scripting (XSS) vulnerability in the /admin/edit_room_controller.php endpoint. The root cause is the lack of effective filtering and escaping of user-supplied data within the room_name parameter. A remote attacker can e...

CVE-2024-42773

An Incorrect Access Control vulnerability exists in the Kashipara Hotel Management System v1.0 . The flaw is located in the /admin/edit_room_controller.php file, which allows an unauthenticated attacker to modify valid hotel room entries within the administrator section. As a mitigation, it is re...

CVE-2024-42774

The Kashipara Hotel Management System v1.0 contains an Incorrect Access Control vulnerability in the /admin/delete_room.php endpoint. This flaw allows an unauthenticated attacker to delete valid hotel room entries within the administrator section. No information regarding a patched version is cur...

CVE-2024-42776

Kashipara Hotel Management System v1.0 is susceptible to an Incorrect Access Control vulnerability via the /admin/users.php API endpoint. An attacker could exploit this flaw to perform unauthorized operations . As of the current documentation, there is no information regarding a newer version con...

CVE-2024-42767

Kashipara Hotel Management System v1.0 is vulnerable to Unrestricted File Upload leading to Remote Code Execution (RCE) . The root cause is a lack of validation for uploaded files in the /admin/add_room_controller.php endpoint. An attacker can exploit this to upload malicious files and execute ar...

CVE-2023-49272

Hotel Management v1.0 is affected by multiple authenticated Reflected XSS flaws. The vulnerability stems from the children parameter in reservation.php, whose value is echoed into the HTML document as plain text. This could allow attackers who have valid access to craft inputs that are reflected ...

CVE-2024-42770

A Stored Cross-Site Scripting (XSS) vulnerability exists in Kashipara Hotel Management System v1.0 within the /core/signup_user.php endpoint. The root cause is the lack of effective filtering and escaping of user-supplied data provided via the user_email parameter. This allows remote attackers to...

CVE-2024-42768

A Cross-Site Request Forgery (CSRF) vulnerability exists in Kashipara Hotel Management System v1.0 within the /admin/delete_room.php endpoint. The root cause is the application's failure to adequately validate that requests originate from a trusted user, allowing an attacker to forge malicious re...

CVE-2024-42775

An Incorrect Access Control vulnerability exists in the Kashipara Hotel Management System v1.0 within the /admin/add_room_controller.php endpoint. This flaw allows an unauthenticated attacker to add valid hotel room entries in the administrator section by using direct URL access . While no patch ...

CVE-2023-49269

CVE-2023-49269 affects Hotel Management v1.0. The vulnerability is an authenticated Reflected Cross-Site Scripting (XSS) in the adults parameter of reservation.php, where input is echoed unmodified in the HTML response and copied into the page between tags. Affected component: reservation.php in ...

CVE-2023-49270

Affected product/versions: Hotel Management v1.0. Vulnerability type: Authenticated Reflected Cross-Site Scripting (XSS). The vulnerability arises because the check_in_date parameter in reservation.php is echoed into the HTML response as plain text between tags, allowing injection of arbitrary HT...

CVE-2023-49271

CVE-2023-49271 affects Hotel Management v1.0. The vulnerability is a set of authenticated Reflected Cross-Site Scripting (XSS) flaws in reservation.php where the check_out_date parameter is copied into the HTML as plaintext and any input is echoed back in the response. Affected component is the r...