CVE-2022-1409: falha em VikBooking Hotel Booking Engine & PMS
VikBooking Hotel Booking Engine & PMS < 1.5.8 - Admin+ PHP File Upload
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 1.5%
The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not properly validate images, allowing high privilege users such as administrators to upload PHP files disguised as images and containing malicious PHP code
Produtos afetados
Unknown · VikBooking Hotel Booking Engine & PMSCVEs relacionadas — VikBooking Hotel Booking Engine & PMS
No mesmo produto, das mais perigosas para as menos.
CVE-2022-1528—VikBooking < 1.5.9 - Reflected Cross-Site ScriptingEPSS 0.8%CVE-2024-2441HIGHVikBooking < 1.6.8 - Insecure Direct Object ReferencesEPSS 0.6%CVE-2022-1408—VikBooking Hotel Booking Engine & PMS < 1.5.8 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2022-1407—VikBooking Hotel Booking Engine & PMS < 1.5.7 - Stored Cross-Site Scripting via CSRFEPSS 0.5%CVE-2026-85127HIGHVikBooking 1.8.8 - 1.8.14 - Unauthenticated Stored XSS via SVG Chat AttachmentEPSS 0.4%CVE-2024-13616MEDIUMVikBooking < 1.7.2 - Admin+ Stored XSSEPSS 0.3%