Vulnerabilidades

Missing Authorization vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: from n/a through <= 4.5.5.

Cross-Site Request Forgery (CSRF) vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita allows Cross Site Request Forgery.This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: from n/a through <= 4.5.5.

Vulnerabilidad de autorización faltante en themetechmount TrueBooker truebooker-appointment-booking permite explotar niveles de seguridad de control de acceso configurados incorrectamente. Este problema afecta a TrueBooker: desde n/a hasta menor o igual que 1.1.0.

Vulnerabilidad de autorización faltante en wpdevart Booking calendar, Appointment Booking System booking-calendar permite la explotación de niveles de seguridad de control de acceso configurados incorrectamente. Este problema afecta a Booking calendar, Appointment Booking System: desde n/a hasta menor o igual que…

Vulnerabilidad de falsificación de petición en sitios cruzados (CSRF) en el sistema de reservas de Dimitri Grassi Salon, salon-booking-system, permite la falsificación de petición en sitios cruzados. Este problema afecta al sistema de reservas Salon booking system: desde n/a hasta menor o igual que 10.30.3.

Vulnerabilidad de Autorización Faltante en Webba Appointment Booking Webba Booking webba-booking-lite permite Explotar Niveles de Seguridad de Control de Acceso Incorrectamente Configurados. Este problema afecta a Webba Booking: desde n/a hasta menor o igual que 6.2.1.

Exposición de Información Sensible del Sistema a una Esfera de Control No Autorizada vulnerabilidad en ThimPress WP Hotel Booking wp-hotel-booking permite Recuperar Datos Sensibles Incrustados. Este problema afecta a WP Hotel Booking: desde n/a hasta menor o igual a 2.2.7.

Vulnerabilidad de falsificación de petición en sitios cruzados (CSRF) en ThimPress WP Hotel Booking wp-hotel-booking permite falsificación de petición en sitios cruzados. Este problema afecta a WP Hotel Booking: desde n/a hasta menor o igual a 2.2.7.

Neutralización Incorrecta de la Entrada Durante la Generación de Páginas Web ('cross-site scripting') vulnerabilidad en ThimPress WP Hotel Booking wp-hotel-booking permite XSS basado en DOM. Este problema afecta a WP Hotel Booking: desde n/a hasta menor o igual que 2.2.7.

Vulnerabilidad de falsificación de petición en sitios cruzados (CSRF) en JK Social Photo Fetcher facebook-photo-fetcher permite la falsificación de petición en sitios cruzados. Este problema afecta a Social Photo Fetcher: desde n/a hasta menor o igual que 3.0.4.

El plugin Booking Calendar para WordPress es vulnerable a cross-site scripting almacenado a través del shortcode 'bookingcalendar' del plugin en todas las versiones hasta la 10.14.6, inclusive, debido a una sanitización de entrada y un escape de salida insuficientes en los atributos proporcionados por el usuario. Esto…

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP…

The Fluent Booking plugin for WordPress is vulnerable to unauthorized calendar import and management due to a missing capability check on the "importCalendar" function in all versions up to, and including, 1.9.11. This makes it possible for authenticated attackers, with subscriber level access and above, to import…

Sending an HTTP request/response body with greater than 2^31 bytes triggers an infinite loop in proxygen::coro::HTTPQuicCoroSession which blocks the backing event loop and unconditionally appends data to a std::vector per-loop iteration. This issue leads to unbounded memory growth and eventually causes the process to…

The Bookme – Free Online Appointment Booking and Scheduling Plugin for WordPress is vulnerable to time-based SQL Injection via the `filter[status]` parameter in all versions up to, and including, 4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL…

Una vulnerabilidad fue identificada en itsourcecode Student Information System 1.0. Afectada por esta vulnerabilidad es una funcionalidad desconocida del archivo /schedule_edit1.php. Tal manipulación del argumento schedule_id conduce a inyección SQL. El ataque puede ser lanzado remotamente. El exploit está disponible…

The Booking Calendar Contact Form plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.2.60. This is due to missing authorization checks and payment verification in the `dex_bccf_check_IPN_verification` function. This makes it possible for unauthenticated attackers to…

The Appointment Booking Calendar plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.3.96. This is due to the plugin exposing an unauthenticated booking processing endpoint (cpabc_appointments_check_IPN_verification) that trusts attacker-supplied payment notifications…

Missing Authorization vulnerability in Sabuj Kundu CBX Bookmark & Favorite cbxwpbookmark allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CBX Bookmark & Favorite: from n/a through <= 2.0.1.

El plugin HotelRunner Booking Widget para WordPress es vulnerable a cross-site scripting almacenado a través del shortcode 'hotelrunner' del plugin en todas las versiones hasta la 5.2.4, inclusive, debido a la sanitización insuficiente de las entradas y al escape de las salidas en los atributos proporcionados por el…

El plugin WPBookit para WordPress es vulnerable a Cross-Site Scripting Almacenado a través del parámetro 'css_code' en todas las versiones hasta la 1.0.6, inclusive, debido a una falta de verificación de capacidad en la función save_custome_code(). Esto posibilita que atacantes no autenticados inyecten scripts web…

The Booking Plugin for WordPress Appointments – Time Slot plugin for WordPress is vulnerable to unauthorized email sending in versions up to, and including, 1.4.7 due to missing validation on the tslot_appt_email AJAX action. This makes it possible for unauthenticated attackers to send appointment notification emails…

A vulnerability was determined in itsourcecode Student Information System 1.0. The affected element is an unknown function of the file /enrollment_edit1.php. Executing manipulation of the argument en_id can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may…

A weakness has been identified in Bdtask Flight Booking Software 4. Affected by this vulnerability is an unknown functionality of the file /agent/profile/edit of the component Edit Profile Page. This manipulation causes unrestricted upload. The attack may be initiated remotely. The exploit has been made available to…

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to SQL Injection via the ‘search’ parameter in all versions up to, and including, 1.2.35 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it…