| Package | Affected versions | Patched versions |
|---|---|---|
| booking core | = 1.7.0 |
The “Subscribe” feature in Ultimate Booking System Booking Core 1.7.0 is vulnerable to CSV formula injection. The input containing the excel formula is not being sanitized by the application. As a result when admin in backend download and open the csv, content of the cells are executed.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free