Priority HIGH 82
An SQL injection vulnerability in the pjActionGetUser function of PHPJabbers Cinema Booking System v2.0 allows attackers to manipulate database queries via the column parameter.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00878 · Published 2025-02-06 · No fix listed CWE-89
Priority HIGH 82
User enumeration is found in in PHPJabbers Ticket Support Script v3.2.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00891 · Published 2023-08-28 · No fix listed CWE-209
Priority HIGH 82
User enumeration is found in PHPJabbers Event Booking Calendar v4.0.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00891 · Published 2023-08-28 · No fix listed CWE-209
Priority HIGH 82
User enumeration is found in PHP Jabbers Car Rental Script v3.0.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00891 · Published 2023-08-28 · No fix listed CWE-209
Priority HIGH 82
User enumeration is found in PHPJabbers Taxi Booking Script v2.0.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01107 · Published 2023-08-28 · No fix listed CWE-209
Priority HIGH 82
User enumeration is found in PHPJabbers Fundraising Script v1.0.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00891 · Published 2023-08-28 · No fix listed CWE-209
Priority HIGH 82
User enumeration is found in PHPJabbers Yacht Listing Script v2.0.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00891 · Published 2023-08-28 · No fix listed CWE-209
Priority HIGH 82
User enumeration is found in PHP Jabbers Hotel Booking System v4.0.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00891 · Published 2023-08-28 · No fix listed CWE-209
Priority HIGH 82
User enumeration is found in PHP Jabbers Restaurant Booking Script v3.0.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00891 · Published 2023-08-28 · No fix listed CWE-209
Priority HIGH 82
User enumeration is found in PHPJabbers Food Delivery Script v3.1.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00891 · Published 2023-08-28 · No fix listed CWE-209
Priority HIGH 82
User enumeration is found in PHPJabbers Callback Widget v1.0.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00891 · Published 2023-08-28 · No fix listed CWE-203
Priority HIGH 82
A File Upload vulnerability in PHPJabbers Ticket Support Script v3.2 allows attackers to execute arbitrary code via uploading a crafted file.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01014 · Published 2023-08-10 · No fix listed CWE-434
Priority HIGH 82
There is a SQL injection (SQLi) vulnerability in the "column" parameter of index.php in PHPJabbers Document Creator v1.0.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00787 · Published 2023-08-10 · No fix listed CWE-89
Priority HIGH 82
In PHPJabbers Cleaning Business Software 1.0, there is no encryption on user passwords allowing an attacker to gain access to all user accounts.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0053 · Published 2023-09-11 · No fix listed CWE-862
Priority HIGH 82
User enumeration is found in in PHP Jabbers Time Slots Booking Calendar v3.3.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00765 · Published 2023-08-01 · No fix listed
Priority HIGH 82
Improper input validation of password parameter in PHP Jabbers Time Slots Booking Calendar v 3.3 results in insecure passwords.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00986 · Published 2023-08-01 · No fix listed
Priority HIGH 75
A stored cross-site scripting (XSS) vulnerability in PHPJabbers Cinema Booking System v2.0 exists due to unsanitized input in file upload fields (event_img, seat_maps) and seat number configurations (number[new_X] in pjA…
CVSS 3.1CRITICAL 9.3· Network · No auth · User interaction · EPSS 0.00764 · Published 2025-02-06 · No fix listed CWE-79
Priority HIGH 74
Phpjabbers PHP Shopping Cart 4.2 is vulnerable to SQL Injection via the id parameter.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00678 · Published 2023-09-21 · No fix listed CWE-89
Priority HIGH 73
PHPJabbers Meeting Room Booking System v1.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00644 · Published 2025-02-20 · No fix listed CWE-1236
Priority HIGH 73
PHPJabbers Cinema Booking System v1.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.0083 · Published 2025-02-20 · No fix listed CWE-1236
Priority HIGH 73
PHPJabbers Bus Reservation System v1.1 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.007 · Published 2025-02-20 · No fix listed CWE-1236
Priority HIGH 73
PHPJabbers Car Park Booking System v3.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00701 · Published 2025-02-20 · No fix listed CWE-1236
Priority HIGH 73
Appointment Scheduler 3.0 is vulnerable to CSV Injection via a Language > Labels > Export action.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01221 · Published 2023-12-07 · No fix listed CWE-74
Priority HIGH 73
PHPJabbers Limo Booking Software 1.0 is vulnerable to Cross Site Request Forgery (CSRF) to add an admin user via the Add Users Function, aka an index.php?controller=pjAdminUsers&action=pjActionCreate URI.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00567 · Published 2023-10-12 · No fix listed CWE-352
Priority HIGH 73
In PHP Jabbers Time Slots Booking Calendar 3.3 , lack of verification when changing an email address and/or password (on the Profile Page) allows remote attackers to take over accounts.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00756 · Published 2023-08-01 · No fix listed CWE-287
Load more
THREATIST.IORead the docs