CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 2CVE-2014-4035 – BSI Advance Hotel Booking System 2.0 - 'booking_details.php Persistent Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2014-4035
Cross-site scripting (XSS) vulnerability in booking_details.php in Best Soft Inc. (BSI) Advance Hotel Booking System 2.0 allows remote attackers to inject arbitrary web script or HTML via the title parameter. Vulnerabilidad de XSS en booking_details.php en Best Soft Inc. (BSI) Advance Hotel Booking System 2.0 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del parámetro del título. BSI Advance Hotel Booking System version 2.0 suffers from a persistent cross site scripting vulnerability in booking_details.php. • https://www.exploit-db.com/exploits/47219 http://packetstormsecurity.com/files/126949/BSI-Advance-Hotel-Booking-System-2.0-Cross-Site-Scripting.html http://packetstormsecurity.com/files/154024/BSI-Advance-Hotel-Booking-System-2.0-Cross-Site-Scripting.html http://www.securityfocus.com/bid/67914 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 4CVE-2010-4814 – BSI Advance Hotel Booking System 1.0 - SQL Injection
https://notcve.org/view.php?id=CVE-2010-4814
SQL injection vulnerability in index1.php in Best Soft Inc. (BSI) Advance Hotel Booking System 1.0 allows remote attackers to execute arbitrary SQL commands via the page parameter. Vulnerabilidad de inyección SQL en index1.php en Best Soft Inc. (BSI) Advance Hotel Booking System v1.0 permite a atacantes remotos ejecutar comandos SQL de su elección a través del parámetro "page". • https://www.exploit-db.com/exploits/15531 http://packetstormsecurity.org/files/view/95829/phpbsiahbs-sql.txt http://www.exploit-db.com/exploits/15531 http://www.securityfocus.com/bid/44854 https://exchange.xforce.ibmcloud.com/vulnerabilities/63268 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •