Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
16 results
Jul 31, 2026A SQL injection vulnerability has been identified in PHP Jabbers - Car Rental Script .CVE-2025-67649 · Websites & servers · PHP Jabbers · reported by cvd@cert.plCritical 9.3
A SQL injection vulnerability has been identified in PHP Jabbers - Car Rental Script . Improper neutralization of input provided by user into parameters responsible for sorting functions allows an unauthenticated attacker to perform SQL Injection attacks. This issue was fixed in version 4.1.
- Product
- Car Rental Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023Car Rental Script 3.0 is vulnerable to Multiple HTML Injection issues via SMS API Key or Default Country Code.CVE-2023-48837 · Websites & servers · Phpjabbers · reported by MITREMedium 5.4
Car Rental Script 3.0 is vulnerable to Multiple HTML Injection issues via SMS API Key or Default Country Code.
- Product
- CAR Rental Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comphpjabbers.com
Dec 7, 2023Car Rental Script 3.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) issues via the name, plugin_sms_api_key, plugin_sms_country_code, calendar_id,CVE-2023-48836 · Websites & servers · Phpjabbers · reported by MITREMedium 5.4
Car Rental Script 3.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) issues via the name, plugin_sms_api_key, plugin_sms_country_code, calendar_id, title, country name, or customer_name parameter.
- Product
- CAR Rental Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comphpjabbers.com
Dec 7, 2023Car Rental Script v3.0 is vulnerable to CSV Injection via a Language > Labels > Export action.CVE-2023-48835 · Websites & servers · Phpjabbers · reported by MITREHigh 8.8
Car Rental Script v3.0 is vulnerable to CSV Injection via a Language > Labels > Export action.
- Product
- CAR Rental Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comphpjabbers.com
Dec 7, 2023A lack of rate limiting in pjActionAjaxSend in Car Rental v3.0 allows attackers to cause resource exhaustion.CVE-2023-48834 · Websites & servers · Phpjabbers · reported by MITREHigh 7.5
A lack of rate limiting in pjActionAjaxSend in Car Rental v3.0 allows attackers to cause resource exhaustion.
- Product
- CAR Rental Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comphpjabbers.com
Aug 28, 2023User enumeration is found in PHP Jabbers Car Rental Script v3.0.CVE-2023-40764 · Websites & servers · Phpjabbers · reported by MITRECritical 9.8
User enumeration is found in PHP Jabbers Car Rental Script v3.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
- Product
- CAR Rental Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmedium.comphpjabbers.com
Aug 28, 2023In PHPJabbers Car Rental Script 3.0, lack of verification when changing an email address and/or password (on the Profile Page) allows remote attackers to take oCVE-2023-40754 · Websites & servers · Phpjabbers · reported by MITREHigh 8.8
In PHPJabbers Car Rental Script 3.0, lack of verification when changing an email address and/or password (on the Profile Page) allows remote attackers to take over accounts.
- Product
- CAR Rental Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmedium.comphpjabbers.com
Jul 19, 2023A vulnerability classified as problematic has been found in GZ Scripts Car Rental Script 1.8.CVE-2023-3757 · Other software · GZ Scripts · reported by VulDBLow 3.5
A vulnerability classified as problematic has been found in GZ Scripts Car Rental Script 1.8. Affected is an unknown function of the file /EventBookingCalendar/load.php?controller=GzFront/action=checkout/cid=1/layout=calendar/show_header=T/local=3. The manipulation of the argument first_name/second_name/phone/address_1/country leads to cross site scripting. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-234432. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Car Rental Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2019PHP Scripts Mall Car Rental Script 2.0.8 has Cross-Site Request Forgery (CSRF) via accountedit.php.CVE-2018-20648 · Other software · CAR Rental Script Project · reported by MITREHigh 8.8
PHP Scripts Mall Car Rental Script 2.0.8 has Cross-Site Request Forgery (CSRF) via accountedit.php.
- Product
- CAR Rental Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2019PHP Scripts Mall Car Rental Script 2.0.8 has directory traversal via a direct request for a listing of an image directory such as an images/ directory.CVE-2018-20647 · Other software · CAR Rental Script Project · reported by MITREMedium 6.5
PHP Scripts Mall Car Rental Script 2.0.8 has directory traversal via a direct request for a listing of an image directory such as an images/ directory.
- Product
- CAR Rental Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2018PHP Scripts Mall Car Rental Script 2.0.8 has XSS via the FirstName and LastName fields.CVE-2018-15182 · Other software · CAR Rental Script Project · reported by MITREMedium 5.4
PHP Scripts Mall Car Rental Script 2.0.8 has XSS via the FirstName and LastName fields.
- Product
- CAR Rental Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2018PHP Scripts Mall Car Rental Script 2.0.8 has XSS via the User Name field in an Edit Profile action.CVE-2018-6904 · Other software · CAR Rental Script Project · reported by MITREMedium 5.4
PHP Scripts Mall Car Rental Script 2.0.8 has XSS via the User Name field in an Edit Profile action.
- Product
- CAR Rental Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record0day4u.wordpress.com0day4u.wordpress.com
Dec 27, 2017PHP Scripts Mall Car Rental Script has XSS via the admin/areaedit.php carid parameter or the admin/sitesettings.php websitename parameter.CVE-2017-17907 · Other software · CAR Rental Script Project · reported by MITREMedium 6.1
PHP Scripts Mall Car Rental Script has XSS via the admin/areaedit.php carid parameter or the admin/sitesettings.php websitename parameter.
- Product
- CAR Rental Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2017PHP Scripts Mall Car Rental Script has SQL Injection via the admin/carlistedit.php carid parameter.CVE-2017-17906 · Other software · CAR Rental Script Project · reported by MITRECritical 9.8
PHP Scripts Mall Car Rental Script has SQL Injection via the admin/carlistedit.php carid parameter.
- Product
- CAR Rental Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2017PHP Scripts Mall Car Rental Script has CSRF via admin/sitesettings.php.CVE-2017-17905 · Other software · CAR Rental Script Project · reported by MITREHigh 8.8
PHP Scripts Mall Car Rental Script has CSRF via admin/sitesettings.php.
- Product
- CAR Rental Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2017Car Rental Script 2.0.4 has SQL Injection via the countrycode1.php val parameter.CVE-2017-17637 · Other software · CAR Rental Script Project · reported by MITRECritical 9.8
Car Rental Script 2.0.4 has SQL Injection via the countrycode1.php val parameter.
- Product
- CAR Rental Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.