Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 22

Export CSV
CVE-2022-1407

VikBooking Hotel Booking Engine & PMS < 1.5.7 - Stored Cross-Site Scripting via CSRF

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not have CSRF check in place when adding a tracking campaign, and does not escape the campaign fields when outputting them In attributes. As a result, attackers could make a logged in admin add tracking campaign with XSS payloads in them via a CSRF attack

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Vikwp
Products
Hotel Booking Engine \& Pms
CVE-2021-24519

Vik Rent Car < 1.1.10 - Authenticated Stored Cross-Site Scripting (XSS)

The VikRentCar Car Rental Management System WordPress plugin before 1.1.10 does not sanitise the 'Text Next to Icon' field when adding or editing a Characteristic, allowing high privilege users such as admin to use XSS payload in it, leading to an authenticated Stored Cross-Site Scripting issue

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Vikwp
Products
Car Rental Management System