Read the docs

Vikwp

Records14All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high5CVSS 7.0–8.9

Exploited now

Vikwp records in CISA KEV

No Vikwp vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Vikbooking Hotel Booking Engine & Pms 7 records MEDIUM Hotel Booking Engine & Pms 3 records LOW Vikbooking Hotel Booking Engine & Property Management System Plugin 2 records MEDIUM Car Rental Management System 1 record LOW Vik Booking 1 record LOW

Records

3 records in Hotel Booking Engine & Pms · all components

TI-2022-01290 CVE-2022-1409 · GHSA-wjwh-xprm-35wv

VikBooking Hotel Booking Engine & PMS < 1.5.8 - Admin+ PHP File Upload

Priority LOW 35

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not properly validate images, allowing high privilege users such as administrators to upload PHP files disguised as images and containing malic…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01472 Published 2022-05-16 Fixed in 1.5.8 CWE-434
TI-2022-01288 CVE-2022-1407 · GHSA-q742-8q6j-9cvw

VikBooking Hotel Booking Engine & PMS < 1.5.7 - Stored Cross-Site Scripting via CSRF

Priority LOW 30

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not have CSRF check in place when adding a tracking campaign, and does not escape the campaign fields when outputting them In attributes.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00542 Published 2022-05-16 Fixed in 1.5.8 CWE-352
TI-2022-01289 CVE-2022-1408 · GHSA-qgp9-pp66-7qwp

VikBooking Hotel Booking Engine & PMS < 1.5.8 - Admin+ Stored Cross-Site Scripting

Priority LOW 23

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not escape various settings before outputting them in attributes, which could allow high privilege users such as admin to perform Cross-Site Sc…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00598 Published 2022-05-16 Fixed in 1.5.8 CWE-79
Open these records in search →