CVE-2024-57429

CVE-2024-57429 is a CSRF vulnerability in PHPJabbers Cinema Booking System v2.0, specifically in the pjActionUpdate function. An attacker can escalate privileges by tricking an authenticated admin into submitting an unauthorized request. Multiple sources in the connected documents corroborate thi...

CVE-2024-57430

CVE-2024-57430 affects PHPJabbers Cinema Booking System v2.0. The vulnerability is an SQL injection in the pjActionGetUser function, exploitable via the column parameter, enabling manipulation of database queries and potentially leading to unauthorized data disclosure, privilege escalation, or da...

CVE-2024-57428

PHPJabbers Cinema Booking System v2.0 is affected by a stored XSS due to unsanitized input in file uploads (event_img, seat_maps) and in seat number configurations (number[new_X] in pjActionCreate). This enables injection of persistent JavaScript for phishing, malware injection, and session hijac...

CVE-2024-57427

CVE-2024-57427 affects PHPJabbers Cinema Booking System version 2.0.0. The vulnerability is a reflected XSS in multiple endpoints that improperly handle user input, enabling attackers to craft links or requests to execute scripts in a victim’s browser. Documented impacts include potential theft o...

CVE-2023-51333

The CVE-2023-51333 entry concerns PHPJabbers Cinema Booking System v1.0 and identifies a CSV Injection vulnerability stemming from insufficient input validation in the Languages section (Labels) of System Options, which is used to construct CSV exports. The vulnerability allows an attacker to cra...

CVE-2023-51334

CVE-2023-51334 affects PHPJabbers Cinema Booking System v1.0, where the Forgot Password / reset mechanism lacks rate limiting. The documented impact is that an attacker can abuse the feature to trigger a large volume of email messages to a legitimate user, potentially causing a Denial of Service....

CVE-2023-51330

CVE-2023-51330 affects PHPJabbers Cinema Booking System v1.0. It is a Reflected Cross-Site Scripting vulnerability in the Now Showing menu's “date” parameter, caused by unsanitized input reflected on the page. CVSSv3.1 base score 5.4 (Medium): AV:N, AC:L, PR:L, UI:R, S:C, C:L, I:L, A:N. An exploi...

CVE-2023-51335

CVE-2023-51335 affects PHPJabbers Cinema Booking System v1.0. The issue is a stored Cross-Site Scripting (XSS) vulnerability in the title and name parameters, as described in multiple sources (NVD entry with CVSS v3.1 base score 6.5; related vendor and security pages). The root cause is not expan...