CVE-2023-51299

PHPJabbers Hotel Booking System v4.0 is vulnerable to HTML Injection (XSS) via parameters name, plugin_sms_api_key, plugin_sms_country_code, and title. Root cause: inputs not properly sanitized, enabling injected HTML/script to be rendered. Public exploit material exists (PacketStorm), indicating...

CVE-2023-51301

The CVE-2023-51301 entry concerns PHPJabbers Hotel Booking System v4.0, where a lack of rate limiting in the Login Section -> Forgot Email workflow allows an attacker to generate a high volume of reset requests for a victim, potentially causing Denial of Service via mass email generation. Publ...

CVE-2023-51302

PHPJabbers Hotel Booking System v4.0 is vulnerable to a CSV Injection flaw. The root cause is insufficient input validation on the Languages/Labels parameters used to construct CSV files, specifically in the Reservations list (Unique ID field). This can allow an attacker to execute remote code vi...

CVE-2023-51297

CVE-2023-51297 describes a lack of rate limiting in the Email Settings feature of PHPJabbers Hotel Booking System v4.0, enabling an attacker to trigger a flood of emails to a legitimate user and potentially cause a Denial of Service. The connected sources consistently state the root cause as miss...

CVE-2023-51300

PHPJabbers Hotel Booking System v4.0 is vulnerable to Cross-Site Scripting (XSS) via multiple input fields (name, plugin_sms_api_key, plugin_sms_country_code, title) as described in the CVE entry. The vulnerability arises in the web application where user-supplied content can be reflected in the ...

CVE-2023-40760

PHP Jabbers Hotel Booking System v4.0 is affected by a user enumeration vulnerability observed during password recovery, where message differences can reveal whether a username exists, enabling brute-force attempts with valid accounts. The issue is described across multiple sources as a user enum...