Overview 320 matches · 5 in Waratek scope · 0 protected · 3 exploited · 1 CISA KEV · 27 public PoC · 3 EPSS ≥ 0.5
320matches
5in Waratek scope1.6%
0protected0.0%
3exploited0.9%
1CISA KEV0.3%
27public PoC8.4%
3EPSS ≥ 0.50.9%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
1
0.3%
No exploit published
4
1.2%
Outside Waratek scope
0
0.0%
Not applicable
315
98.4%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
320
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 59 / year
20051
Not applicable1
Medium1
not blocked1
Working exploit published1
20065
Not applicable5
High3
Medium2
not blocked5
Working exploit published3
No public exploit2
20070
20081
Not applicable1
High1
not blocked1
Working exploit published1
20097
Not applicable7
High1
Medium6
not blocked7
Working exploit published6
No public exploit1
201021
Not applicable21
High3
Medium14
Low4
not blocked21
Working exploit published1
No public exploit20
20110
20128
Not applicable8
High1
Medium6
Low1
not blocked8
Working exploit published3
No public exploit5
20137
Mitigation candidate1
No exploit published4
Not applicable2
High5
Medium2
not blocked7
Working exploit published1
No public exploit6
201411
Not applicable11
High2
Medium9
not blocked11
No public exploit11
20153
Not applicable3
Medium3
not blocked3
Working exploit published1
No public exploit2
20161
Not applicable1
High1
not blocked1
No public exploit1
20178
Not applicable8
Critical1
High3
Medium4
not blocked8
Exploited1
Proof of concept only1
No public exploit6
201811
Not applicable11
Critical1
High6
Medium4
not blocked11
Exploited1
Working exploit published3
No public exploit7
20197
Not applicable7
Critical1
Medium6
not blocked7
No public exploit7
20206
Not applicable6
Critical1
High4
Medium1
not blocked6
Working exploit published1
No public exploit5
202112
Not applicable12
Critical2
High3
Medium5
Low2
not blocked12
No public exploit12
202245
Not applicable45
Critical8
High24
Medium13
not blocked45
Exploited1
Proof of concept only12
No public exploit32
202351
Not applicable51
Critical11
High24
Medium16
not blocked51
Proof of concept only10
No public exploit41
202444
Not applicable44
Critical13
High8
Medium22
Low1
not blocked44
Working exploit published2
Proof of concept only19
No public exploit23
202559
Not applicable59
Critical5
High8
Medium41
Low5
not blocked59
Proof of concept only40
No public exploit19
202612
Not applicable12
Critical1
High8
Medium3
not blocked12
Proof of concept only3
No public exploit9
20062008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-116098 | Medium | 2026-10-26 | Not applicable | No public exploit | A vulnerability was detected in SteelRaven7 Ravenfield 25407073. This vulnerability affects the function cacheCoverPoints of the component RFL Custom Map Handler/RFLD Custom Map Handler. Performing a manipulation results in deserialization. Remote exploitation of the attack is possible. The patch is named EA39 Security Patch. Applying a patch is the recommended action to fix this issue. |
| CVE-2026-88028 | High | 2026-09-10 | Not applicable | No public exploit | Improper neutralization of special elements in data query logic in the polymorphic relation handling of the MongoDB integration for Laravel can cause a caller-supplied relation identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence a stored relation identifier may cause an affected application to return a document other than the intended relation target. |
| CVE-2026-88027 | High | 2026-09-10 | Not applicable | No public exploit | Improper neutralization of special elements in data query logic in the embedded-document relation handling of the MongoDB integration for Laravel can cause a caller-supplied embedded record identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence such an identifier may delete all embedded documents in a targeted record or overwrite an embedded document other than the intended target. |
| CVE-2026-88022 | High | 2026-09-10 | Not applicable | No public exploit | Improper neutralization of special elements in data query logic in the MongoDB integration for Laravel can cause an array supplied to an explicit equality filter to be interpreted as a query condition rather than as a literal value. This affects the three-argument `where` method when the operator is `=` or `eq`, as well as the `find` and `delete` methods that use that code path. An attacker who can cause an affected application to supply an operator-shaped array to one of these APIs may obtain a document other than the intended target or delete documents beyond the intended target. |
| CVE-2025-59868 | Medium | 2026-06-27 | Not applicable | No public exploit | HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a sensitive data exposure vulnerability which could allow an attacker to exploit application information to then attempt additional attacks and cause unknown behavior in the application. |
| CVE-2023-37524 | High | 2026-06-27 | Not applicable | No public exploit | HCL Traveler for Microsoft Outlook (HTMO) is susceptible to vulnerabilities due to .NET Framework 4.5 being out of service. Since .NET Framework 4.5 has reached end-of-life and no longer receives security updates, it may expose the application to publicly known security weaknesses through vulnerable third-party components. |
| CVE-2024-23581 | High | 2026-06-26 | Not applicable | No public exploit | The HCL Traveler for Microsoft Outlook libraries are being flagged as potentially malicious software or an unrecognized application. |
| CVE-2026-35183 | High | 2026-04-06 | Not applicable | Proof of concept only | Brave CMS is an open-source CMS. Prior to 2.0.6, an Insecure Direct Object Reference (IDOR) vulnerability exists in the article image deletion feature. It is located in app/Http/Controllers/Dashboard/ArticleController.php within the deleteImage method. The endpoint accepts a filename from the URL but does not verify ownership. This allows an authenticated user with edit permissions to delete images attached to articles owned by other users. This vulnerability is fixed in 2.0.6. |
| CVE-2026-35182 | High | 2026-04-06 | Not applicable | Proof of concept only | Brave CMS is an open-source CMS. Prior to 2.0.6, this vulnerability is a missing authorization check found in the update role endpoint at routes/web.php. The POST route for /rights/update-role/{id} lacks the checkUserPermissions:assign-user-roles middleware. This allows any authenticated user to change account roles and promote themselves to Super Admin. This vulnerability is fixed in 2.0.6. |
| CVE-2026-35164 | High | 2026-04-06 | Not applicable | Proof of concept only | Brave CMS is an open-source CMS. Prior to 2.0.6, an unrestricted file upload vulnerability exists in the CKEditor upload functionality. It is found in app/Http/Controllers/Dashboard/CkEditorController.php within the ckupload method. The method fails to validate uploaded file types and relies entirely on user input. This allows an authenticated user to upload executable PHP scripts and gain Remote Code Execution. This vulnerability is fixed in 2.0.6. |
| CVE-2026-35047 | Critical | 2026-04-06 | Not applicable | No public exploit | Brave CMS is an open-source CMS. Prior to 2.0.6, an Unrestricted File Upload vulnerability in the CKEditor endpoint allows attackers to upload arbitrary files, including executable scripts. This may lead to Remote Code Execution (RCE) on the server, potentially resulting in full system compromise, data exfiltration, or service disruption. All users running affected versions of BraveCMS are impacted. This vulnerability is fixed in 2.0.6. |
| CVE-2026-21783 | Medium | 2026-03-24 | Not applicable | No public exploit | HCL Traveler is affected by sensitive information disclosure. The application generates some error messages that provide detailed information about errors and failures, such as internal paths, file names, sensitive tokens, credentials, error codes, or stack traces. Attackers could exploit this information to gain insights into the system's architecture and potentially launch targeted attacks. |
| CVE-2025-69030 | Medium | 2025-12-30 | Not applicable | No public exploit | Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Backpack Traveler backpacktraveler allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Backpack Traveler: from n/a through <= 2.10.3. |
| CVE-2025-58900 | High | 2025-12-18 | Not applicable | No public exploit | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes UniTravel unitravel allows PHP Local File Inclusion.This issue affects UniTravel: from n/a through <= 1.4.2. |
| CVE-2025-68129 | High | 2025-12-17 | Not applicable | No public exploit | Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. In applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens. Projects are affected if they use Auth0-PHP SDK versions between v8.0.0 and v8.17.0, or applications using the following SDKs that rely on the Auth0-PHP SDK versions between v8.0.0 and v8.17.0: Auth0/symfony versions between 5.0.0 and 5.5.0, Auth0/laravel-auth0 versions between 7.0.0 and 7.19.0, and/or Auth0/wordpress plugin versions between 5.0.0-BETA0 and 5.4.0. Auth0/Auth0-PHP version 8.18.0 contains a patch for the issue. |
| CVE-2025-65346 | Critical | 2025-12-04 | Not applicable | Proof of concept only | alexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal. The unzip/extraction functionality improperly allows archive contents to be written to arbitrary locations on the filesystem due to insufficient validation of extraction paths. |
| CVE-2025-65345 | Medium | 2025-12-03 | Not applicable | No public exploit | alexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal. The zip/archiving functionality allows an attacker to create archives containing files and directories outside the intended scope due to improper path validation. |
| CVE-2025-13546 | Low | 2025-11-23 | Not applicable | No public exploit | A vulnerability was detected in ashraf-kabir travel-agency up to 1f25aa03544bc5fb7a9e846f8a7879cecdb0cad3. Affected by this issue is some unknown functionality of the file /results.php of the component Search. The manipulation of the argument user_query results in sql injection. The attack can be launched remotely. The exploit is now public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. |
| CVE-2025-13545 | Low | 2025-11-23 | Not applicable | No public exploit | A security vulnerability has been detected in ashraf-kabir travel-agency up to 1f25aa03544bc5fb7a9e846f8a7879cecdb0cad3. Affected by this vulnerability is an unknown functionality of the file /admin_area/index.php. The manipulation of the argument edit_pack leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2025-13544 | Low | 2025-11-23 | Not applicable | Proof of concept only | A weakness has been identified in ashraf-kabir travel-agency up to 1f25aa03544bc5fb7a9e846f8a7879cecdb0cad3. Affected is an unknown function of the file /customer_register.php. Executing manipulation can lead to unrestricted upload. It is possible to launch the attack remotely. The exploit has been made available to the public and could be exploited. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2025-63307 | High | 2025-11-06 | Not applicable | Proof of concept only | alexusmai laravel-file-manager 3.3.1 is vulnerable to Cross Site Scripting (XSS). The application permits user-controlled upload, create, and rename of files to HTML and SVG types and serves those files inline without adequate content-type validation or output sanitization. |
| CVE-2024-42192 | Medium | 2025-10-16 | Not applicable | No public exploit | HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a credential leakage which could allow an attacker to access other computers or applications. |
| CVE-2025-11103 | Low | 2025-09-28 | Not applicable | Proof of concept only | A security vulnerability has been detected in Projectworlds Online Tours and Travels 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/change-image.php. The manipulation of the argument packageimage leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. |
| CVE-2025-9928 | Medium | 2025-09-03 | Not applicable | Proof of concept only | A security flaw has been discovered in projectworlds Travel Management System 1.0. The impacted element is an unknown function of the file /viewcategory.php. Performing manipulation of the argument t1 results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited. |
| CVE-2025-9927 | Medium | 2025-09-03 | Not applicable | Proof of concept only | A vulnerability was identified in projectworlds Travel Management System 1.0. The affected element is an unknown function of the file /viewpackage.php. Such manipulation of the argument t1 leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used. |
| CVE-2025-9926 | Medium | 2025-09-03 | Not applicable | Proof of concept only | A vulnerability was determined in projectworlds Travel Management System 1.0. Impacted is an unknown function of the file /viewsubcategory.php. This manipulation of the argument t1 causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. |
| CVE-2025-9925 | Medium | 2025-09-03 | Not applicable | Proof of concept only | A vulnerability was found in projectworlds Travel Management System 1.0. This issue affects some unknown processing of the file /detail.php. The manipulation of the argument pid results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used. |
| CVE-2025-9924 | Medium | 2025-09-03 | Not applicable | Proof of concept only | A vulnerability has been found in projectworlds Travel Management System 1.0. This vulnerability affects unknown code of the file /enquiry.php. The manipulation of the argument t2 leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. |
| CVE-2025-9426 | Medium | 2025-08-25 | Not applicable | No public exploit | A weakness has been identified in itsourcecode Online Tour and Travel Management System 1.0. This affects an unknown part of the file /package.php. Executing manipulation of the argument subcatid can lead to sql injection. The attack may be performed from a remote location. The exploit has been made available to the public and could be exploited. |
| CVE-2025-9425 | Medium | 2025-08-25 | Not applicable | Proof of concept only | A security flaw has been discovered in itsourcecode Online Tour and Travel Management System 1.0. Affected by this issue is some unknown functionality of the file /enquiry.php. Performing manipulation of the argument pid results in sql injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be exploited. |
| CVE-2025-9155 | Medium | 2025-08-19 | Not applicable | Proof of concept only | A vulnerability has been found in itsourcecode Online Tour and Travel Management System 1.0. Impacted is an unknown function of the file /user/forget_password.php. Such manipulation of the argument email leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. |
| CVE-2025-9154 | Medium | 2025-08-19 | Not applicable | Proof of concept only | A flaw has been found in itsourcecode Online Tour and Travel Management System 1.0. This issue affects some unknown processing of the file /user/page-login.php. This manipulation of the argument email causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used. |
| CVE-2025-9153 | Low | 2025-08-19 | Not applicable | Proof of concept only | A vulnerability was detected in itsourcecode Online Tour and Travel Management System 1.0. This vulnerability affects unknown code of the file /admin/operations/travellers.php. The manipulation of the argument photo results in unrestricted upload. The attack can be launched remotely. The exploit is now public and may be used. |
| CVE-2025-9053 | Medium | 2025-08-15 | Not applicable | Proof of concept only | A vulnerability has been found in projectworlds Travel Management System 1.0. This vulnerability affects unknown code of the file /updatesubcategory.php. The manipulation of the argument t1/s1 leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. |
| CVE-2025-9052 | Medium | 2025-08-15 | Not applicable | Proof of concept only | A vulnerability was identified in projectworlds Travel Management System 1.0. This affects an unknown part of the file /updatepackage.php. The manipulation of the argument s1 leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. |
| CVE-2025-9051 | Medium | 2025-08-15 | Not applicable | Proof of concept only | A vulnerability was determined in projectworlds Travel Management System 1.0. Affected by this issue is some unknown functionality of the file /updatecategory.php. The manipulation of the argument t1 leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. |
| CVE-2025-9050 | Medium | 2025-08-15 | Not applicable | Proof of concept only | A vulnerability was found in projectworlds Travel Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /addcategory.php. The manipulation of the argument t1 leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. |
| CVE-2025-9010 | Medium | 2025-08-15 | Not applicable | Proof of concept only | A vulnerability was found in itsourcecode Online Tour and Travel Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/booking_report.php. The manipulation of the argument from_date leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. |
| CVE-2025-9009 | Medium | 2025-08-15 | Not applicable | Proof of concept only | A vulnerability has been found in itsourcecode Online Tour and Travel Management System 1.0. Affected is an unknown function of the file /admin/email_setup.php. The manipulation of the argument Name leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. |
| CVE-2025-9008 | Medium | 2025-08-15 | Not applicable | Proof of concept only | A vulnerability was identified in itsourcecode Online Tour and Travel Management System 1.0. This issue affects some unknown processing of the file /admin/sms_setting.php. The manipulation of the argument uname leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. |
| CVE-2025-8993 | Medium | 2025-08-15 | Not applicable | Proof of concept only | A vulnerability was found in itsourcecode Online Tour and Travel Management System 1.0. This affects an unknown part of the file /admin/expense_report.php. The manipulation of the argument from_date leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. |
| CVE-2025-8984 | Medium | 2025-08-14 | Not applicable | Proof of concept only | A vulnerability has been found in itsourcecode Online Tour and Travel Management System 1.0. Affected is an unknown function of the file /admin/operations/expense_category.php. The manipulation of the argument expense_name leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. |
| CVE-2025-8983 | Medium | 2025-08-14 | Not applicable | Proof of concept only | A vulnerability was identified in itsourcecode Online Tour and Travel Management System 1.0. This issue affects some unknown processing of the file /admin/operations/expense.php. The manipulation of the argument expense_for leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. |
| CVE-2025-8982 | Medium | 2025-08-14 | Not applicable | Proof of concept only | A vulnerability was determined in itsourcecode Online Tour and Travel Management System 1.0. This vulnerability affects unknown code of the file /admin/operations/currency.php. The manipulation of the argument curr_code leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. |
| CVE-2025-8981 | Medium | 2025-08-14 | Not applicable | Proof of concept only | A vulnerability was found in itsourcecode Online Tour and Travel Management System 1.0. This affects an unknown part of the file /admin/operations/payment.php. The manipulation of the argument payment_type leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. |
| CVE-2025-8972 | Medium | 2025-08-14 | Not applicable | Proof of concept only | A vulnerability was identified in itsourcecode Online Tour and Travel Management System 1.0. This issue affects some unknown processing of the file /admin/page-login.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. |
| CVE-2025-8971 | Medium | 2025-08-14 | Not applicable | Proof of concept only | A vulnerability was determined in itsourcecode Online Tour and Travel Management System 1.0. This vulnerability affects unknown code of the file /admin/operations/travellers.php. The manipulation of the argument val-username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. |
| CVE-2025-8970 | Medium | 2025-08-14 | Not applicable | Proof of concept only | A vulnerability was found in itsourcecode Online Tour and Travel Management System 1.0. This affects an unknown part of the file /admin/operations/booking.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. |
| CVE-2025-8969 | Medium | 2025-08-14 | Not applicable | Proof of concept only | A vulnerability has been found in itsourcecode Online Tour and Travel Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/approve_user.php. The manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. |
| CVE-2025-8968 | Medium | 2025-08-14 | Not applicable | Proof of concept only | A vulnerability was identified in itsourcecode Online Tour and Travel Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/disapprove_user.php. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. |
| CVE-2025-8967 | Medium | 2025-08-14 | Not applicable | Proof of concept only | A vulnerability was determined in itsourcecode Online Tour and Travel Management System 1.0. Affected is an unknown function of the file /admin/operations/packages.php. The manipulation of the argument pname leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. |
| CVE-2025-8966 | Medium | 2025-08-14 | Not applicable | Proof of concept only | A vulnerability was found in itsourcecode Online Tour and Travel Management System 1.0. This issue affects some unknown processing of the file /admin/operations/tax.php. The manipulation of the argument tname leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. |
| CVE-2025-5282 | High | 2025-06-13 | Not applicable | No public exploit | The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the delete_package() function in all versions up to, and including, 6.5.1. This makes it possible for unauthenticated attackers to delete arbitrary posts. |
| CVE-2024-42191 | Critical | 2025-05-30 | Not applicable | No public exploit | HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a COM hijacking vulnerability which could allow an attacker to modify or replace the application with malicious content. |
| CVE-2024-42190 | Critical | 2025-05-30 | Not applicable | No public exploit | HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a DLL hijacking vulnerability which could allow an attacker to modify or replace the application with malicious content. |
| CVE-2025-39490 | High | 2025-05-23 | Not applicable | No public exploit | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Backpack Traveler backpacktraveler allows PHP Local File Inclusion.This issue affects Backpack Traveler: from n/a through <= 2.10.2. |
| CVE-2023-5934 | High | 2025-05-15 | Not applicable | Proof of concept only | The Travelpayouts: All Travel Brands in One Place WordPress plugin before 1.1.13 does not have CSRF check in place when importing settings from the v1, which could allow attackers to make a logged in admin update some settings via a CSRF attack |
| CVE-2023-5932 | Medium | 2025-05-15 | Not applicable | Proof of concept only | The Travelpayouts: All Travel Brands in One Place WordPress plugin before 1.1.14 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin |
| CVE-2025-4067 | Medium | 2025-04-29 | Not applicable | Proof of concept only | A vulnerability classified as critical has been found in ScriptAndTools Online-Travling-System 1.0. Affected is an unknown function of the file /admin/viewpackage.php. The manipulation leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. |
| CVE-2025-4066 | Medium | 2025-04-29 | Not applicable | Proof of concept only | A vulnerability was found in ScriptAndTools Online-Travling-System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/addpackage.php. The manipulation leads to improper access controls. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. |
| CVE-2025-4065 | Medium | 2025-04-29 | Not applicable | Proof of concept only | A vulnerability was found in ScriptAndTools Online-Travling-System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/addadvertisement.php. The manipulation leads to improper access controls. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. |
| CVE-2025-4064 | Medium | 2025-04-29 | Not applicable | Proof of concept only | A vulnerability was found in ScriptAndTools Online-Travling-System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/viewenquiry.php. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. |
| CVE-2025-0279 | Medium | 2025-04-03 | Not applicable | No public exploit | HCL Traveler generates some error messages that provide detailed information about errors and failures, such as internal paths, file names, sensitive tokens, credentials, error codes, or stack traces. Attackers could exploit this information to gain insights into the system's architecture and potentially launch targeted attacks. |
| CVE-2025-0278 | Medium | 2025-04-03 | Not applicable | No public exploit | HCL Traveler is affected by an internal path disclosure in a Windows application when the application inadvertently reveals internal file paths, in error messages, debug logs, or responses to user requests. |
| CVE-2025-30870 | Critical | 2025-04-01 | Not applicable | No public exploit | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Travel Engine WP Travel Engine wp-travel-engine allows PHP Local File Inclusion.This issue affects WP Travel Engine: from n/a through <= 6.3.5. |
| CVE-2025-30871 | High | 2025-03-27 | Not applicable | No public exploit | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Travel Engine WP Travel Engine wp-travel-engine allows PHP Local File Inclusion.This issue affects WP Travel Engine: from n/a through <= 6.3.5. |
| CVE-2025-1773 | Medium | 2025-03-15 | Not applicable | No public exploit | The Traveler theme for WordPress is vulnerable to Reflected Cross-Site Scripting via multiple parameters in all versions up to, and including, 3.1.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. |
| CVE-2025-1771 | Critical | 2025-03-15 | Not applicable | No public exploit | The Traveler theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.1.8 via the 'hotel_alone_load_more_post' function 'style' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included. |
| CVE-2025-0229 | Medium | 2025-01-05 | Not applicable | Proof of concept only | A vulnerability, which was classified as critical, has been found in code-projects Travel Management System 1.0. This issue affects some unknown processing of the file /enquiry.php. The manipulation of the argument pid/t1/t2/t3/t4/t5/t6/t7 leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. |
| CVE-2024-37451 | High | 2025-01-02 | Not applicable | No public exploit | Cross-Site Request Forgery (CSRF) vulnerability in raratheme Travel Agency travel-agency allows Cross Site Request Forgery.This issue affects Travel Agency: from n/a through <= 1.4.9. |
| CVE-2024-11846 | Medium | 2025-01-01 | Not applicable | Proof of concept only | The does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin |
| CVE-2024-12950 | Medium | 2024-12-26 | Not applicable | Proof of concept only | A vulnerability was found in code-projects/projectworlds Travel Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /subcat.php. The manipulation of the argument catid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. |
| CVE-2024-12949 | Medium | 2024-12-26 | Not applicable | Proof of concept only | A vulnerability was found in code-projects Travel Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /package.php. The manipulation of the argument subcatid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. |
| CVE-2024-12948 | Medium | 2024-12-26 | Not applicable | Proof of concept only | A vulnerability was found in code-projects Travel Management System 1.0. It has been classified as critical. This affects an unknown part of the file /detail.php. The manipulation of the argument pid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. |
| CVE-2024-10606 | Medium | 2024-11-23 | Not applicable | No public exploit | The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpte_onboard_save_function_callback() function in all versions up to, and including, 6.2.1. This makes it possible for authenticated attackers, with contributor-level access and above, to modify several settings that could have an impact such as lost revenue and page updates. |
| CVE-2024-30133 | Medium | 2024-11-12 | Not applicable | No public exploit | HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a control flow vulnerability. The application does not sufficiently manage its control flow during execution, creating conditions in which the control flow can be modified in unexpected ways. |
| CVE-2024-51152 | High | 2024-11-08 | Not applicable | No public exploit | File Upload vulnerability in Laravel CMS v.1.4.7 and before allows a remote attacker to execute arbitrary code via the shell.php a component. |
| CVE-2024-10920 | Low | 2024-11-06 | Not applicable | Proof of concept only | A vulnerability was found in mariazevedo88 travels-java-api up to 5.0.1 and classified as problematic. Affected by this issue is the function doFilterInternal of the file travels-java-api-master\src\main\java\io\github\mariazevedo88\travelsjavaapi\filters\JwtAuthenticationTokenFilter.java of the component JWT Secret Handler. The manipulation leads to use of hard-coded cryptographic key . The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. |
| CVE-2024-51328 | Medium | 2024-11-04 | Not applicable | Proof of concept only | Cross Site Scripting vulnerability in addcategory.php in projectworld's Travel Management System v1.0 allows remote attacker to inject arbitrary code via the t2 parameter. |
| CVE-2024-51327 | Critical | 2024-11-04 | Not applicable | Proof of concept only | SQL Injection in loginform.php in ProjectWorld's Travel Management System v1.0 allows remote attackers to bypass authentication via SQL Injection in the 'username' and 'password' fields. |
| CVE-2024-51326 | High | 2024-11-04 | Not applicable | Proof of concept only | SQL Injection vulnerability in projectworlds Travel management System v.1.0 allows a remote attacker to execute arbitrary code via the 't2' parameter in deletesubcategory.php. |
| CVE-2024-48411 | Critical | 2024-10-15 | Not applicable | No public exploit | itsourcecode Online Tours and Travels Management System v1.0 is vulnerable to SQL Injection (SQLI) via a crafted payload to the val-email parameter in forget_password.php. |
| CVE-2024-46077 | Medium | 2024-10-04 | Not applicable | Proof of concept only | itsourcecode Online Tours and Travels Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via a crafted payload to the val-username, val-email, val-suggestions, val-digits and state_name parameters in travellers.php. |
| CVE-2024-30134 | High | 2024-09-26 | Not applicable | No public exploit | The HCL Traveler for Microsoft Outlook executable (HTMO.exe) is being flagged as potentially Malicious Software or an Unrecognized Application. |
| CVE-2024-43337 | Medium | 2024-08-26 | Not applicable | No public exploit | Cross-Site Request Forgery (CSRF) vulnerability in Brave Brave Popup Builder.This issue affects Brave Popup Builder: from n/a through 0.7.0. |
| CVE-2024-7945 | Medium | 2024-08-20 | Not applicable | Proof of concept only | A vulnerability was found in itsourcecode Laravel Property Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/notes/create of the component Notes Page. The manipulation of the argument Note text leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. |
| CVE-2024-7944 | Medium | 2024-08-20 | Not applicable | No public exploit | A vulnerability was found in itsourcecode Laravel Property Management System 1.0. It has been classified as critical. Affected is the function UpdateDocumentsRequest of the file DocumentsController.php. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. |
| CVE-2024-7943 | Medium | 2024-08-20 | Not applicable | Proof of concept only | A vulnerability was found in itsourcecode Laravel Property Management System 1.0 and classified as critical. This issue affects the function upload of the file PropertiesController.php. The manipulation of the argument file leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. |
| CVE-2024-7495 | Medium | 2024-08-06 | Not applicable | No public exploit | A vulnerability, which was classified as critical, was found in itsourcecode Laravel Accounting System 1.0. This affects an unknown part of the file app/Http/Controllers/HomeController.php. The manipulation of the argument image leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-273621 was assigned to this vulnerability. |
| CVE-2024-7067 | Medium | 2024-07-24 | Not applicable | Proof of concept only | A vulnerability was found in kirilkirkov Ecommerce-Laravel-Bootstrap up to 1f1097a3448ce8ec53e034ea0f70b8e2a0e64a87. It has been rated as critical. Affected by this issue is the function getCartProductsIds of the file app/Cart.php. The manipulation of the argument laraCart leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The name of the patch is a02111a674ab49f65018b31da3011b1e396f59b1. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-272348. |
| CVE-2024-37944 | Medium | 2024-07-20 | Not applicable | No public exploit | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WP Travel Engine allows Stored XSS.This issue affects WP Travel Engine: from n/a through 5.9.1. |
| CVE-2024-37952 | High | 2024-07-09 | Not applicable | No public exploit | Improper Privilege Management vulnerability in themeenergy BookYourTravel allows Privilege Escalation.This issue affects BookYourTravel: from n/a through 8.18.17. |
| CVE-2024-6471 | Medium | 2024-07-03 | Not applicable | Proof of concept only | A vulnerability classified as critical has been found in SourceCodester Online Tours & Travels Management 1.0. This affects an unknown part of the file sms_setting.php. The manipulation of the argument uname leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-270279. |
| CVE-2022-27540 | High | 2024-06-28 | Not applicable | No public exploit | A potential Time-of-Check to Time-of Use (TOCTOU) vulnerability has been identified in the HP BIOS for certain HP PC products, which might allow arbitrary code execution, denial of service, and information disclosure. HP is releasing BIOS updates to mitigate the potential vulnerability. |
| CVE-2024-1153 | Medium | 2024-06-27 | Not applicable | No public exploit | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Talya Informatics Travel APPS allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Travel APPS: before v17.0.68. |
| CVE-2024-1107 | Critical | 2024-06-27 | Not applicable | No public exploit | Authorization Bypass Through User-Controlled Key vulnerability in Talya Informatics Travel APPS allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Travel APPS: before v17.0.68. |
| CVE-2024-6056 | Medium | 2024-06-17 | Not applicable | Proof of concept only | A vulnerability was found in nasirkhan Laravel Starter up to 11.8.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /forgot-password of the component Password Reset Handler. The manipulation of the argument Email leads to observable response discrepancy. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-268784. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2024-32798 | High | 2024-06-09 | Not applicable | No public exploit | Missing Authorization vulnerability in WP Travel Engine.This issue affects WP Travel Engine: from n/a through 5.8.0. |
| CVE-2024-35655 | Medium | 2024-06-04 | Not applicable | No public exploit | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brave Brave brave-popup-builder allows DOM-Based XSS.This issue affects Brave: from n/a through <= 0.6.9. |
| CVE-2024-30504 | High | 2024-03-29 | Not applicable | No public exploit | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Travel Engine.This issue affects WP Travel Engine: from n/a through 5.7.9. |