Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

3 records

Vendor: Vikwp Component: Hotel Booking Engine & Pms Clear all filters
TI-2022-01290 CVE-2022-1409 · GHSA-wjwh-xprm-35wv

VikBooking Hotel Booking Engine & PMS < 1.5.8 - Admin+ PHP File Upload

Priority LOW 35

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not properly validate images, allowing high privilege users such as administrators to upload PHP files disguised as images and containing malic…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01472 Published 2022-05-16 Fixed in 1.5.8 CWE-434
TI-2022-01289 CVE-2022-1408 · GHSA-qgp9-pp66-7qwp

VikBooking Hotel Booking Engine & PMS < 1.5.8 - Admin+ Stored Cross-Site Scripting

Priority LOW 23

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not escape various settings before outputting them in attributes, which could allow high privilege users such as admin to perform Cross-Site Sc…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00598 Published 2022-05-16 Fixed in 1.5.8 CWE-79
TI-2022-01288 CVE-2022-1407 · GHSA-q742-8q6j-9cvw

VikBooking Hotel Booking Engine & PMS < 1.5.7 - Stored Cross-Site Scripting via CSRF

Priority LOW 30

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not have CSRF check in place when adding a tracking campaign, and does not escape the campaign fields when outputting them In attributes.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00542 Published 2022-05-16 Fixed in 1.5.8 CWE-352