booking project booking vulnerabilities and exploits

(subscribe to this query)

6.1

CVSSv3

The nd-booking plugin prior to 2.5 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.

Booking Project Booking

8.8

CVSSv3

The Booking Calendar plugin for WordPress is vulnerable to PHP Object Injection via the [bookingflextimeline] shortcode in versions up to, and including, 9.1. This could be exploited by subscriber-level users and above to call arbitrary PHP objects on a vulnerable site.

Booking Calendar Project Booking Calendar

5.3

CVSSv3

Directory traversal vulnerability in Booking Calendar version 7.0 and previous versions allows remote malicious users to read arbitrary files via specially crafted captcha_chalange parameter.

Booking Calendar Project Booking Calendar

6.1

CVSSv3

The Booking Calendar WordPress plugin prior to 8.9.2 does not sanitise and escape the booking_type parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting

Booking Calendar Project Booking Calendar

6.1

CVSSv3

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in CodePeople Booking Calendar Contact Form plugin <= 1.2.40 versions.

Booking Calendar Project Booking Calendar

6.1

CVSSv3

Cross-site scripting vulnerability in Booking Calendar version 7.1 and previous versions allows remote malicious users to inject arbitrary web script or HTML via unspecified vectors.

Booking Calendar Project Booking Calendar

4.8

CVSSv3

An issue exists in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php sale_conditions[count][] parameter.

Booking Calendar Project Booking Calendar 2.1.7

4.8

CVSSv3

An issue exists in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php extra_field1[items][field_item1][price_percent] parameter.

Booking Calendar Project Booking Calendar 2.1.7

4.8

CVSSv3

An issue exists in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php form_field5[label] parameter.

Booking Calendar Project Booking Calendar 2.1.7

8.8

CVSSv3

An issue exists in the booking-calendar plugin 2.1.7 for WordPress. CSRF exists via wp-admin/admin.php.

Booking Calendar Project Booking Calendar 2.1.7

Get Started

1 2 3 4 5 6 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook