CVE-2022-1409: vulnerability in VikBooking Hotel Booking Engine & PMS
VikBooking Hotel Booking Engine & PMS < 1.5.8 - Admin+ PHP File Upload
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 1.5%
The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not properly validate images, allowing high privilege users such as administrators to upload PHP files disguised as images and containing malicious PHP code
Affected products
Unknown · VikBooking Hotel Booking Engine & PMSRelated CVEs — VikBooking Hotel Booking Engine & PMS
In the same product, most dangerous first.
CVE-2022-1528—VikBooking < 1.5.9 - Reflected Cross-Site ScriptingEPSS 0.8%CVE-2024-2441HIGHVikBooking < 1.6.8 - Insecure Direct Object ReferencesEPSS 0.6%CVE-2022-1408—VikBooking Hotel Booking Engine & PMS < 1.5.8 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2022-1407—VikBooking Hotel Booking Engine & PMS < 1.5.7 - Stored Cross-Site Scripting via CSRFEPSS 0.5%CVE-2026-85127HIGHVikBooking 1.8.8 - 1.8.14 - Unauthenticated Stored XSS via SVG Chat AttachmentEPSS 0.4%CVE-2024-13616MEDIUMVikBooking < 1.7.2 - Admin+ Stored XSSEPSS 0.3%