Online Lesson Booking System Vulnerabilities

Cross-Site Request Forgery (CSRF) and Cross-Site Scripting (XSS) vulnerabilities found by Cryptography Laboratory in WordPress Online Lesson Booking plugin (versions <= 0.8.6).

Affected:

up to 0.8.7

Fixed in:

0.8.7

Disclosed:

Jul 10, 2019

[en] Cross-site request forgery (CSRF) vulnerability in Online Lesson Booking 0.8.6 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.

Affected:

up to 0.8.7

Fixed in:

0.8.7

Disclosed:

Jul 5, 2019

CVE-2019-5973 on NVD →

[en] Cross-site scripting vulnerability in Online Lesson Booking 0.8.6 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Affected:

up to 0.8.7

Fixed in:

0.8.7

Disclosed:

Jul 5, 2019

CVE-2019-5972 on NVD →

Cross-site request forgery (CSRF) vulnerability in Online Lesson Booking 0.8.6 and earlier allows remote attackers to hijack the authentication of administrators via several vectors.

CVSS:

8.8

Affected:

up to 0.8.6

Fixed in:

0.8.7

Disclosed:

Jun 10, 2019

CVE-2019-5973 on NVD →

Cross-site scripting vulnerability in Online Lesson Booking 0.8.6 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVSS:

6.1

Affected:

up to 0.8.6

Fixed in:

0.8.7

Disclosed:

Jun 10, 2019

CVE-2019-5972 on NVD →