CVE-2023-48834

CVE-2023-48834 affects Car Rental Script v3.0, caused by a missing rate limit in the function pjActionAjaxSend, enabling unauthenticated attackers to exhaust resources over the network. Exploitation context is supported by multiple sources (e.g., PT-Security guidance and public writeups). Remedia...

CVE-2023-48836

CVE-2023-48836 – Car Rental Script 3.0 is vulnerable to multiple stored Cross-Site Scripting (XSS) issues. The vulnerability is triggered by input stored and later rendered unsafely via parameters such as name, plugin_sms_api_key, plugin_sms_country_code, calendar_id, title, country name, and cus...

CVE-2023-40754

CVE-2023-40754 affects PHPJabbers Car Rental Script 3.0. The issue is a lack of verification when changing the email address and/or password on the Profile Page, allowing remote attackers to take over accounts. Exploitation details are not provided in the sources, and no official fix/version is s...

CVE-2023-40764

CVE-2023-40764 affects PHP Jabbers Car Rental Script v3.0. The issue is a user-enumeration flaw in the password-recovery flow: differences in response messages reveal whether a username exists, enabling brute-force attempts with valid users. The CVSSv3.1 base score is high (9.8, Critical) with ne...

CVE-2023-48837

CVE-2023-48837 affects PHPJabbers Car Rental Script v3.0. It is vulnerable to multiple HTML injection (XSS) via the SMS API Key and Default Country Code fields due to inadequate input sanitization. Impact is described as HTML injection; CVSS v3.1 base score 5.4 (Medium). Exploitation details are ...

CVE-2023-48835

CVE-2023-48835 affects Car Rental Script v3.0; the vulnerability is a CSV Injection in the Language > Labels > Export action due to insufficient input validation on the Unique ID field in Reservations. Impact is high (C:H, I:H, A:H) with CVSS 3.1 base score 8.8. In-the-wild/exploit details ...