Phpjabbers
11 CVEs across 41 Phpjabbers products. Browse Phpjabbers vulnerabilities, severities, and proof-of-concept exploits.
Phpjabbers products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-53927 | Medium | 5.4 | 2025-12-17 | PHPJabbers Simple CMS 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through section… |
CVE-2023-53926 | Critical | 9.8 | 2025-12-17 | PHPJabbers Simple CMS 5.0 contains a SQL injection vulnerability in the 'column' parameter that allows remote attackers to manipulate database queries. Attacke… |
CVE-2023-53878 | | 2025-12-15 | Member Login Script 3.3 contains a client-side desynchronization vulnerability that allows attackers to manipulate HTTP request handling by exploiting Content-… | |
CVE-2023-53877 | Critical | 9.8 | 2025-12-15 | Bus Reservation System 1.1 contains a SQL injection vulnerability in the pickup_id parameter that allows attackers to manipulate database queries. Attackers ca… |
CVE-2025-10827 | Medium | 4.3 | 2025-09-23 | A weakness has been identified in PHPJabbers Restaurant Menu Maker up to 1.1. Affected by this issue is some unknown functionality of the file /preview.php. Th… |
CVE-2023-51328 | Medium | 5.4 | 2025-05-08 | PHPJabbers Cleaning Business Software v1.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) in the "c_name, name" parameters. |
CVE-2023-51295 | Medium | 6.5 | 2025-05-08 | PHPJabbers Event Booking Calendar v4.0 is vulnerable to Multiple HTML Injection in the "name, plugin_sms_api_key, plugin_sms_country_code, title, plugin_sms_ap… |
CVE-2023-51339 | Medium | 6.5 | 2025-02-20 | A lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Event Ticketing System v1.0 allows attackers to send an excessive amount of email for a… |
CVE-2023-51338 | Medium | 5.4 | 2025-02-20 | PHPJabbers Meeting Room Booking System v1.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) in the "title, name" parameters of index.php … |
CVE-2023-51337 | Medium | 5.4 | 2025-02-20 | PHPJabbers Event Ticketing System v1.0 is vulnerable to Reflected Cross-Site Scripting (XSS) in "lid" parameter in index. |
CVE-2023-51336 | High | 8.8 | 2025-02-20 | PHPJabbers Meeting Room Booking System v1.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code. The vulnerability exi… |
CVE-2023-51335 | Medium | 6.5 | 2025-02-20 | PHPJabbers Cinema Booking System v1.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) in the "title, name" parameters. |
CVE-2023-51334 | Medium | 5.3 | 2025-02-20 | A lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Cinema Booking System v1.0 allows attackers to send an excessive amount of email for a l… |
CVE-2023-51333 | High | 8.8 | 2025-02-20 | PHPJabbers Cinema Booking System v1.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code. The vulnerability exists du… |
CVE-2023-51332 | Medium | 4.3 | 2025-02-20 | A lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Meeting Room Booking System v1.0 allows attackers to send an excessive amount of email f… |
CVE-2023-51331 | Medium | 6.5 | 2025-02-20 | PHPJabbers Cleaning Business Software v1.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code. The vulnerability exis… |
CVE-2023-51330 | Medium | 5.4 | 2025-02-20 | PHPJabbers Cinema Booking System v1.0 is vulnerable to Reflected Cross-Site Scripting (XSS) in Now Showing menu "date" parameter. |
CVE-2023-51327 | Medium | 6.5 | 2025-02-20 | A lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Cleaning Business Software v1.0 allows attackers to send an excessive amount of email fo… |
CVE-2023-51326 | Medium | 6.5 | 2025-02-20 | A lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Cleaning Business Software v1.0 allows attackers to send an excessive amount of email fo… |
CVE-2023-51325 | Medium | 5.4 | 2025-02-20 | PHPJabbers Shared Asset Booking System v1.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) in the "title, name" parameters. |
CVE-2023-51324 | Medium | 6.5 | 2025-02-20 | PHPJabbers Shared Asset Booking System v1.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code. The vulnerability exi… |
CVE-2023-51323 | Medium | 6.5 | 2025-02-20 | A lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Shared Asset Booking System v1.0 allows attackers to send an excessive amount of email f… |
CVE-2023-51321 | Medium | 6.5 | 2025-02-20 | A lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Night Club Booking Software v1.0 allows attackers to send an excessive amount of email f… |
CVE-2023-51320 | Medium | 5.3 | 2025-02-20 | PHPJabbers Night Club Booking Software v1.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code. The vulnerability exi… |
CVE-2023-51319 | High | 8.8 | 2025-02-20 | PHPJabbers Bus Reservation System v1.1 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code. The vulnerability exists d… |
CVE-2023-51318 | Medium | 5.4 | 2025-02-20 | PHPJabbers Bus Reservation System v1.1 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) in the "title, name" parameters. |
CVE-2023-51317 | Medium | 6.5 | 2025-02-20 | PHPJabbers Restaurant Booking System v3.0 is vulnerable to Multiple HTML Injection in the "name, plugin_sms_api_key, plugin_sms_country_code, title, plugin_sms… |
CVE-2023-51316 | High | 7.5 | 2025-02-20 | A lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Bus Reservation System v1.1 allows attackers to send an excessive amount of email for a… |
CVE-2023-51315 | Medium | 5.4 | 2025-02-20 | PHPJabbers Restaurant Booking System v3.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) in the "seat_name, plugin_sms_api_key, plugin_sms_country… |
CVE-2023-51314 | High | 7.5 | 2025-02-20 | A lack of rate limiting in the 'Forgot Password', 'Email Settings' feature of PHPJabbers Restaurant Booking System v3.0 allows attackers to send an excessive a… |
CVE-2023-51313 | High | 8.8 | 2025-02-20 | PHPJabbers Restaurant Booking System v3.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code. The vulnerability exist… |
CVE-2023-51312 | Medium | 5.4 | 2025-02-20 | PHPJabbers Restaurant Booking System v3.0 is vulnerable to Reflected Cross-Site Scripting (XSS) in Reservations menu, Schedule section date parameter. |
CVE-2023-51311 | High | 8.8 | 2025-02-20 | PHPJabbers Car Park Booking System v3.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code. The vulnerability exists… |
CVE-2023-51310 | Medium | 4.3 | 2025-02-20 | A lack of rate limiting in the 'Forgot Password', 'Email Settings' feature of PHPJabbers Car Park Booking System v3.0 allows attackers to send an excessive amo… |
CVE-2023-51309 | Medium | 4.3 | 2025-02-20 | A lack of rate limiting in the 'Email Settings' feature of PHPJabbers Car Park Booking System v3.0 allows attackers to send an excessive amount of email for a… |
CVE-2023-51308 | Medium | 6.1 | 2025-02-20 | PHPJabbers Car Park Booking System v3.0 is vulnerable to Multiple HTML Injection in the "name, plugin_sms_api_key, plugin_sms_country_code, title, plugin_sms_a… |
CVE-2023-51306 | Medium | 5.4 | 2025-02-20 | PHPJabbers Event Ticketing System v1.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) in the "name, title" parameters. |
CVE-2023-51303 | Medium | 6.1 | 2025-02-19 | PHPJabbers Event Ticketing System v1.0 is vulnerable to Multiple HTML Injection in the "lid, name, plugin_sms_api_key, plugin_sms_country_code, title, plugin_s… |
CVE-2023-51302 | High | 8.8 | 2025-02-19 | PHPJabbers Hotel Booking System v4.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code. The vulnerability exists due… |
CVE-2023-51301 | High | 7.5 | 2025-02-19 | A lack of rate limiting in the "Login Section, Forgot Email" feature of PHPJabbers Hotel Booking System v4.0 allows attackers to send an excessive amount of re… |
CVE-2023-51300 | Medium | 6.1 | 2025-02-19 | PHPJabbers Hotel Booking System v4.0 is vulnerable to Cross-Site Scripting (XSS) vulnerabilities in the "name, plugin_sms_api_key, plugin_sms_country_code, tit… |
CVE-2023-51299 | Medium | 6.1 | 2025-02-19 | PHPJabbers Hotel Booking System v4.0 is vulnerable to HTML Injection in the "name, plugin_sms_api_key, plugin_sms_country_code, title, plugin_sms_api_key, titl… |
CVE-2023-51298 | Medium | 4.7 | 2025-02-19 | PHPJabbers Event Booking Calendar v4.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code. The vulnerability exists d… |
CVE-2023-51297 | Medium | 6.5 | 2025-02-19 | A lack of rate limiting in the 'Email Settings' feature of PHPJabbers Hotel Booking System v4.0 allows attackers to send an excessive amount of email for a leg… |
CVE-2023-51296 | Medium | 6.1 | 2025-02-19 | PHPJabbers Event Booking Calendar v4.0 is vulnerable to Cross-Site Scripting (XSS) in the "name, plugin_sms_api_key, plugin_sms_country_code, title, plugin_sms… |
CVE-2023-51293 | High | 7.5 | 2025-02-19 | A lack of rate limiting in the 'Forgot Password', 'Email Settings' feature of PHPJabbers Event Booking Calendar v4.0 allows attackers to send an excessive amou… |
CVE-2024-57430 | Critical | 9.8 | 2025-02-06 | An SQL injection vulnerability in the pjActionGetUser function of PHPJabbers Cinema Booking System v2.0 allows attackers to manipulate database queries via the… |
CVE-2024-57429 | Medium | 5.4 | 2025-02-06 | A cross-site request forgery (CSRF) vulnerability in the pjActionUpdate function of PHPJabbers Cinema Booking System v2.0 allows remote attackers to escalate p… |
CVE-2024-57428 | Critical | 9.3 | 2025-02-06 | A stored cross-site scripting (XSS) vulnerability in PHPJabbers Cinema Booking System v2.0 exists due to unsanitized input in file upload fields (event_img, se… |
CVE-2024-57427 | Medium | 6.1 | 2025-02-06 | PHPJabbers Cinema Booking System v2.0 is vulnerable to reflected cross-site scripting (XSS). Multiple endpoints improperly handle user input, allowing maliciou… |
CVE-2023-48841 | High | 8.8 | 2023-12-07 | Appointment Scheduler 3.0 is vulnerable to CSV Injection via a Language > Labels > Export action. |
CVE-2023-48840 | High | 7.5 | 2023-12-07 | A lack of rate limiting in pjActionAjaxSend in Appointment Scheduler 3.0 allows attackers to cause resource exhaustion. |
CVE-2023-48839 | Medium | 5.4 | 2023-12-07 | Appointment Scheduler 3.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) issues via the name, plugin_sms_api_key, plugin_sms_country_code, calenda… |
CVE-2023-48838 | Medium | 5.4 | 2023-12-07 | Appointment Scheduler 3.0 is vulnerable to Multiple HTML Injection issues via the SMS API Key or Default Country Code. |
CVE-2023-48837 | Medium | 5.4 | 2023-12-07 | Car Rental Script 3.0 is vulnerable to Multiple HTML Injection issues via SMS API Key or Default Country Code. |
CVE-2023-48836 | Medium | 5.4 | 2023-12-07 | Car Rental Script 3.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) issues via the name, plugin_sms_api_key, plugin_sms_country_code, calendar_id… |
CVE-2023-48835 | High | 8.8 | 2023-12-07 | Car Rental Script v3.0 is vulnerable to CSV Injection via a Language > Labels > Export action. |
CVE-2023-48834 | High | 7.5 | 2023-12-07 | A lack of rate limiting in pjActionAjaxSend in Car Rental v3.0 allows attackers to cause resource exhaustion. |
CVE-2023-48833 | High | 7.5 | 2023-12-07 | A lack of rate limiting in pjActionAJaxSend in Time Slots Booking Calendar 4.0 allows attackers to cause resource exhaustion. |
CVE-2023-48831 | High | 7.5 | 2023-12-07 | A lack of rate limiting in pjActionAJaxSend in Availability Booking Calendar 5.0 allows attackers to cause resource exhaustion. |
CVE-2023-48830 | High | 8.8 | 2023-12-07 | Shuttle Booking Software 2.0 is vulnerable to CSV Injection in the Languages section via an export. |
CVE-2023-48828 | Medium | 5.4 | 2023-12-07 | Time Slots Booking Calendar 4.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) issues via the name, plugin_sms_api_key, plugin_sms_country_code, c… |
CVE-2023-48827 | Medium | 5.4 | 2023-12-07 | Time Slots Booking Calendar 4.0 is vulnerable to Multiple HTML Injection issues via the name, plugin_sms_api_key, plugin_sms_country_code, calendar_id, title… |
CVE-2023-48826 | High | 8.8 | 2023-12-07 | Time Slots Booking Calendar 4.0 is vulnerable to CSV Injection via the unique ID field of the Reservations List. |
CVE-2023-48825 | Medium | 5.4 | 2023-12-07 | Availability Booking Calendar 5.0 is vulnerable to Multiple HTML Injection issues via SMS API Key or Default Country Code. |
CVE-2023-48208 | Medium | 6.1 | 2023-12-07 | A Cross Site Scripting vulnerability in Availability Booking Calendar 5.0 allows an attacker to inject JavaScript via the name, plugin_sms_api_key, plugin_sms_… |
CVE-2023-48207 | High | 8.8 | 2023-12-07 | Availability Booking Calendar 5.0 allows CSV injection via the unique ID field in the Reservations list component. |
CVE-2023-48172 | Medium | 5.4 | 2023-12-07 | A Cross Site Scripting (XSS) vulnerability in Shuttle Booking Software 2.0 allows a remote attacker to inject JavaScript via the name, description, title, or a… |
CVE-2023-43147 | High | 8.8 | 2023-10-12 | PHPJabbers Limo Booking Software 1.0 is vulnerable to Cross Site Request Forgery (CSRF) to add an admin user via the Add Users Function, aka an index.php?contr… |
CVE-2023-36127 | High | 7.5 | 2023-10-10 | User enumeration is found in in PHPJabbers Appointment Scheduler 3.0. This issue occurs during password recovery, where a difference in messages could allow an… |
CVE-2023-36126 | Medium | 6.1 | 2023-10-10 | There is a Cross Site Scripting (XSS) vulnerability in the "theme" parameter of preview.php in PHPJabbers Appointment Scheduler v3.0 |
CVE-2023-43274 | High | 7.5 | 2023-09-21 | Phpjabbers PHP Shopping Cart 4.2 is vulnerable to SQL Injection via the id parameter. |
CVE-2023-36140 | Critical | 9.8 | 2023-09-11 | In PHPJabbers Cleaning Business Software 1.0, there is no encryption on user passwords allowing an attacker to gain access to all user accounts. |
CVE-2023-41539 | High | 7.5 | 2023-08-30 | phpjabbers Business Directory Script 3.2 is vulnerable to SQL Injection via the column parameter. |
CVE-2023-41538 | Medium | 6.1 | 2023-08-30 | phpjabbers PHP Forum Script 3.0 is vulnerable to Cross Site Scripting (XSS) via the keyword parameter. |
CVE-2023-41537 | Medium | 6.1 | 2023-08-30 | phpjabbers Business Directory Script 3.2 is vulnerable to Cross Site Scripting (XSS) via the keyword parameter. |
CVE-2023-40767 | Critical | 9.8 | 2023-08-28 | User enumeration is found in in PHPJabbers Make an Offer Widget v1.0. This issue occurs during password recovery, where a difference in messages could allow an… |
CVE-2023-40766 | Critical | 9.8 | 2023-08-28 | User enumeration is found in in PHPJabbers Ticket Support Script v3.2. This issue occurs during password recovery, where a difference in messages could allow a… |
CVE-2023-40765 | Critical | 9.8 | 2023-08-28 | User enumeration is found in PHPJabbers Event Booking Calendar v4.0. This issue occurs during password recovery, where a difference in messages could allow an… |
CVE-2023-40764 | Critical | 9.8 | 2023-08-28 | User enumeration is found in PHP Jabbers Car Rental Script v3.0. This issue occurs during password recovery, where a difference in messages could allow an atta… |
CVE-2023-40763 | Critical | 9.8 | 2023-08-28 | User enumeration is found in PHPJabbers Taxi Booking Script v2.0. This issue occurs during password recovery, where a difference in messages could allow an att… |
CVE-2023-40762 | Critical | 9.8 | 2023-08-28 | User enumeration is found in PHPJabbers Fundraising Script v1.0. This issue occurs during password recovery, where a difference in messages could allow an atta… |
CVE-2023-40761 | Critical | 9.8 | 2023-08-28 | User enumeration is found in PHPJabbers Yacht Listing Script v2.0. This issue occurs during password recovery, where a difference in messages could allow an at… |
CVE-2023-40760 | Critical | 9.8 | 2023-08-28 | User enumeration is found in PHP Jabbers Hotel Booking System v4.0. This issue occurs during password recovery, where a difference in messages could allow an a… |
CVE-2023-40759 | Critical | 9.8 | 2023-08-28 | User enumeration is found in PHP Jabbers Restaurant Booking Script v3.0. This issue occurs during password recovery, where a difference in messages could allow… |
CVE-2023-40758 | Critical | 9.8 | 2023-08-28 | User enumeration is found in PHPJabbers Document Creator v1.0. This issue occurs during password recovery, where a difference in messages could allow an attack… |
CVE-2023-40757 | Critical | 9.8 | 2023-08-28 | User enumeration is found in PHPJabbers Food Delivery Script v3.1. This issue occurs during password recovery, where a difference in messages could allow an at… |
CVE-2023-40756 | Critical | 9.8 | 2023-08-28 | User enumeration is found in PHPJabbers Callback Widget v1.0. This issue occurs during password recovery, where a difference in messages could allow an attacke… |
CVE-2023-40755 | Medium | 6.1 | 2023-08-28 | There is a Cross Site Scripting (XSS) vulnerability in the "theme" parameter of preview.php in PHPJabbers Callback Widget v1.0. |
CVE-2023-40754 | High | 8.8 | 2023-08-28 | In PHPJabbers Car Rental Script 3.0, lack of verification when changing an email address and/or password (on the Profile Page) allows remote attackers to take… |
CVE-2023-40753 | Medium | 5.4 | 2023-08-28 | There is a Cross Site Scripting (XSS) vulnerability in the message parameter of index.php in PHPJabbers Ticket Support Script v3.2. |
CVE-2023-40752 | Medium | 6.1 | 2023-08-28 | There is a Cross Site Scripting (XSS) vulnerability in the "action" parameter of index.php in PHPJabbers Make an Offer Widget v1.0. |
CVE-2023-40751 | Medium | 6.1 | 2023-08-28 | PHPJabbers Fundraising Script v1.0 is vulnerable to Cross Site Scripting (XSS) via the "action" parameter of index.php. |
CVE-2023-40750 | Medium | 6.1 | 2023-08-28 | There is a Cross Site Scripting (XSS) vulnerability in the "action" parameter of index.php in PHPJabbers Yacht Listing Script v1.0. |
CVE-2023-40749 | Critical | 9.8 | 2023-08-28 | PHPJabbers Food Delivery Script v3.0 is vulnerable to SQL Injection in the "column" parameter of index.php. |
CVE-2023-40748 | Critical | 9.8 | 2023-08-28 | PHPJabbers Food Delivery Script 3.0 has a SQL injection (SQLi) vulnerability in the "q" parameter of index.php. |
CVE-2023-36315 | Medium | 6.1 | 2023-08-10 | There is a Cross Site Scripting (XSS) vulnerability in the "action" parameter of index.php in PHPJabbers Callback Widget v1.0. |
CVE-2023-36314 | Medium | 6.1 | 2023-08-10 | There is a Cross Site Scripting (XSS) vulnerability in the value-text-o_sms_email_request_message parameters of index.php in PHPJabbers Callback Widget v1.0. |
CVE-2023-36313 | Medium | 6.1 | 2023-08-10 | PHPJabbers Document Creator v1.0 is vulnerable to Cross Site Scripting (XSS) via all post parameters of "Export Requests" aside from "request_feed". |
CVE-2023-36312 | Medium | 5.4 | 2023-08-10 | There is a Cross Site Scripting (XSS) vulnerability in the value-enum-o_bf_include_timezone parameter of index.php in PHPJabbers Callback Widget v1.0. |