CVE-2014-100008

The CVE concerns the WordPress plugin JS Multi Hotel (aka JS MultiHotel/Js-Multi-Hotel) and its file includes/delete_img.php. The vulnerability is a cross-site scripting flaw (XSS) that allows remote attackers to inject arbitrary web script or HTML via the path parameter in versions up to 2.2.1 a...

CVE-2014-100009

Affected software: WordPress plugin JS Multi Hotel (aka JS MultiHotel, Js-Multi-Hotel), version 2.2.1 and earlier. Vulnerability: path disclosure via direct requests to multiple PHP files (functions.php, myCalendar.php, refreshDate.php, show_image.php, widget.php, phpthumb/GdThumb.inc.php, phpthu...

CVE-2013-7419

CVE-2013-7419 refers to a reflected XSS in the WordPress plugin Joomlaskin JS Multi Hotel (JS Multi Hotel) 2.2.1. The vulnerability is triggered in includes/refreshDate.php via the roomid parameter, allowing arbitrary web script/HTML injection in the user’s browser. The available documents identi...