CVE-2023-51293

PHPJabbers Event Booking Calendar version 4.0 is vulnerable to a Denial of Service (DoS) attack due to a lack of rate limiting in the 'Forgot Password' and 'Email Settings' features. An attacker can exploit this to trigger an excessive amount of emails for a legitimate user, potentially exhaustin...

CVE-2023-51295

PHPJabbers Event Booking Calendar v4.0 is vulnerable to Multiple HTML Injection and Stored Cross-Site Scripting (XSS) . The root cause is the improper neutralization of special elements in the name, plugin_sms_api_key, plugin_sms_country_code, and title parameters, which allows attackers to injec...

CVE-2023-40765

Affected software: PHPJabbers Event Booking Calendar v4.0. Vulnerability: user enumeration during the password recovery flow, where messages differ for valid versus invalid usernames. This in turn can enable brute-forcing of existing accounts. The issue is consistently described across multiple s...

CVE-2023-51296

PHPJabbers Event Booking Calendar v4.0 is vulnerable to Cross-Site Scripting (XSS) and HTML injection . The flaw exists in the name , plugin_sms_api_key , plugin_sms_country_code , and title parameters, which can allow an attacker to execute arbitrary code . While no specific patch version is cur...

CVE-2014-10014

This CVE concerns PHPJabbers Event Booking Calendar 2.0 with multiple CSRF vulnerabilities. The affected component paths include AdminOptions (update action that can change administrator username/password), AdminEvents (create action with event_title that can lead to XSS), and AdminCategories (cr...

CVE-2023-51298

PHPJabbers Event Booking Calendar v4.0 is susceptible to a CSV Injection vulnerability. The root cause is insufficient input validation on the Labels any parameters field within the Languages section of System Options , which is used to construct CSV files. This flaw could allow an attacker to ex...

CVE-2014-10015

CVE-2014-10015 is a SQL injection vulnerability in the PHPJabbers Event Booking Calendar 2.0, specifically in load-calendar.php where the vulnerable parameter is cid . The issue allows remote attackers to execute arbitrary SQL commands, as described across multiple sources (NVD entry and corrobor...