CVE-2023-50864

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Travel Website v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'hotelId' parameter of the hotelDetails.php resource does not validate the characters received and they are sent unfiltered to the database.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Jan 4, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-508659.8Travel Website v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'city' parameter of the hotelSearch.php resCVE-2023-508669.8Travel Website v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'username' parameter of the loginAction.phpCVE-2023-508679.8Travel Website v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'username' parameter of the signupAction.phCVE-2023-508687.5The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denCVE-2023-50875.4The Page Builder: Pagelayer WordPress plugin before 1.7.8 doesn't prevent attackers with author privileges and higher from inserting malicioCVE-2023-508708.8In JetBrains TeamCity before 2023.11.1 a CSRF on login was possibleCVE-2023-508714.3In JetBrains YouTrack before 2023.3.22268 authorization check for inline comments inside thread replies was missedCVE-2023-508727.5The API in Accredible Credential.net December 6th, 2023 allows an Insecure Direct Object Reference attack that discloses partial informationCVE-2023-508738.8Cross-Site Request Forgery (CSRF) vulnerability in Marios Alexandrou Add Any Extension to Pages.This issue affects Add Any Extension to PageCVE-2023-508745.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Darren Cooney WordPress Infinite ScrolCVE-2023-508755.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic Sensei LMS – Online CoursesCVE-2023-508764.3Missing Authorization vulnerability in Molongui Molongui allows Exploiting Incorrectly Configured Access Control Security Levels.This issue
CVE-2023-50864: Critical severity, CVSS 9.8 | Vulnix