CVE-2024-57430

The PHPJabbers Cinema Booking System v2.0 contains an SQL injection vulnerability within the pjActionGetUser function. The flaw originates from the improper neutralization of the column parameter, allowing attackers to manipulate database queries. This vulnerability can lead to unauthorized infor...

CVE-2023-51334

The PHPJabbers Cinema Booking System v1.0 is vulnerable to a Denial of Service (DoS) attack due to a lack of rate limiting in the 'Forgot Password' feature. An attacker can exploit this by sending an excessive amount of requests, causing the system to generate a large volume of emails for a legit...

CVE-2024-57429

The PHPJabbers Cinema Booking System v2.0 is vulnerable to a Cross-Site Request Forgery (CSRF) vulnerability in the pjActionUpdate function. Remote attackers can trick an authenticated administrator into submitting unauthorized requests, leading to privilege escalation . Specifically, an attacker...

CVE-2024-57427

PHPJabbers Cinema Booking System v2.0 is vulnerable to reflected cross-site scripting (XSS) due to improper handling of user input across multiple endpoints. An attacker can craft malicious links to execute arbitrary JavaScript in a victim's browser, potentially leading to session cookie theft or...

CVE-2024-57428

PHPJabbers Cinema Booking System v2.0 is vulnerable to a stored cross-site scripting (XSS) vulnerability caused by unsanitized input in specific fields. The affected components include the file upload fields (event_img , seat_maps ) and the seat number configurations (number[new_X] in pjActionCre...

CVE-2023-51333

The PHPJabbers Cinema Booking System v1.0 is vulnerable to a CSV Injection (CWE-1236) that allows for remote code execution . The root cause is insufficient input validation on the Labels parameter field within the Languages section of System Options , which is used to construct a CSV file. As a ...

CVE-2023-51330

The PHPJabbers Cinema Booking System v1.0 is vulnerable to Reflected Cross-Site Scripting (XSS) (and potentially stored XSS) within the Now Showing menu. The root cause is the improper neutralization of input during web page generation, specifically affecting the "date" parameter . This flaw allo...

CVE-2023-51335

The PHPJabbers Cinema Booking System v1.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) due to improper neutralization of input in the "title" and "name" parameters. An attacker can inject malicious scripts into the system, potentially resulting in unauthorized access or data theft ...