CVE-2022-1407: falha em VikBooking Hotel Booking Engine & PMS
VikBooking Hotel Booking Engine & PMS < 1.5.7 - Stored Cross-Site Scripting via CSRF
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 0.5%
The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not have CSRF check in place when adding a tracking campaign, and does not escape the campaign fields when outputting them In attributes. As a result, attackers could make a logged in admin add tracking campaign with XSS payloads in them via a CSRF attack
Produtos afetados
Unknown · VikBooking Hotel Booking Engine & PMSCVEs relacionadas — VikBooking Hotel Booking Engine & PMS
No mesmo produto, das mais perigosas para as menos.
CVE-2022-1409—VikBooking Hotel Booking Engine & PMS < 1.5.8 - Admin+ PHP File UploadEPSS 1.5%CVE-2022-1528—VikBooking < 1.5.9 - Reflected Cross-Site ScriptingEPSS 0.8%CVE-2024-2441HIGHVikBooking < 1.6.8 - Insecure Direct Object ReferencesEPSS 0.6%CVE-2022-1408—VikBooking Hotel Booking Engine & PMS < 1.5.8 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2026-85127HIGHVikBooking 1.8.8 - 1.8.14 - Unauthenticated Stored XSS via SVG Chat AttachmentEPSS 0.4%CVE-2024-13616MEDIUMVikBooking < 1.7.2 - Admin+ Stored XSSEPSS 0.3%