VikRentCar Car Rental Management System

An unauthenticated attacker can store script-bearing input that is later rendered without sufficient output escaping. A victim must view or otherwise interact with the affected content for script execution in the site origin. The export does not identify the exact attacker or victim WordPress roles. The endpoint, action and parameter are not disclosed. The CNA vector records limited confidentiality impact, limited integrity impact, limited availability impact. Affected versions: at most 1.4.8.

An unauthenticated attacker can craft script-bearing input that reaches the response without adequate escaping. A victim must interact with the crafted request or page for script to execute in the site origin; the victim role is not disclosed. The endpoint, action and parameter are not disclosed. The CNA vector records limited confidentiality impact, limited integrity impact, limited availability impact. Affected versions: at most 1.4.8.

An attacker without a site account can induce a victim to send a forged request that VikRentCar accepts without sufficient cross-site request forgery protection. The vector requires victim interaction and indicates high confidentiality, integrity and availability impact. The exact victim role, endpoint, action, parameters and resulting operation are not disclosed; the export does not establish a particular account takeover or code-execution path. Affected versions: at most 1.4.8. The completed CNA record identifies 1.4.9 as fixed.

An attacker without an account can supply input that is reflected into browser output without sufficient neutralization. Script can execute under the site's origin when a victim interacts with the crafted request or response. The revised export identifies reflected XSS but does not name the endpoint, parameter, rendering function, output context or victim role. The supplied vector reports limited confidentiality, integrity and availability impact and requires victim interaction. Affected versions: <= 1.4.7. No fixed release is confirmed. The checked official release remains 1.4.7; its general XSS-prevention changelog entry does not identify this issue and does not establish a fix beyond the affected range.

VikRentCar is affected by broken access control. The vulnerable path is reachable without authentication. A successful request can reach data or an operation that should be restricted to another user or a more privileged role. The published affected range is n/a through 1.4.5.

VikRentCar Car Rental Management System is affected by SQL injection. Exploitation requires an authenticated administrator account. A successful request can alter database queries and expose or modify WordPress data.

VikRentCar Car Rental Management System is affected by dangerous file upload. Exploitation requires an authenticated administrator account. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.

VikRentCar Car Rental Management System is affected by code execution. The vulnerable path is reachable without authentication. Successful exploitation can run attacker-controlled code in the WordPress hosting account.

VikRentCar is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.

VikRentCar Car Rental Management System is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.

VikRentCar is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

Vikrentcar is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.