Vikrentcar
Approved changes feed: RSS · Atom
cpe:2.3:a:e4jconnect:vikrentcar:*:*:*:*:*:wordpress:*:*
part: a version: * update: *
| Vendor | E4Jconnect (8c646c2b-e20b-5617-91b1-9b84b815e9c6) |
|---|---|
| Product | Vikrentcar (6cdd6e25-d6f0-5b1a-ad42-cadd92252b1c) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | wordpress |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-5322 |
vulnerable | 2026-06-08 07:35:24.650659 |
VikRentCar Car Rental Management System <= 1.4.3 - Authenticated (Administrator+) Arbitrary File Upload
HIGH (7.2)
The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the do_updatecar and createcar functions in all versions up to, and including, 1.4.3. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server, which may make remote code execution possible.
Published: 2025-07-03T21:24:34.738Z
Updated: 2026-04-08T16:56:23.195Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-39653 |
vulnerable | 2026-06-08 06:41:51.288416 |
WordPress VikRentCar Car Rental Management System plugin <= 1.4.0 - SQL Injection vulnerability
CRITICAL (9.3)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in E4J s.R.L. VikRentCar allows SQL Injection.This issue affects VikRentCar: from n/a through 1.4.0.
Published: 2024-08-29T14:20:54.955Z
Updated: 2026-04-28T16:10:07.683Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-1845 |
vulnerable | 2026-06-08 06:27:14.676141 |
VikRentCar Car Rental Management System < 1.3.2 - Cross Site Request Forgery
The VikRentCar Car Rental Management System WordPress plugin before 1.3.2 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
Published: 2024-07-11T06:00:02.403Z
Updated: 2024-08-01T18:56:22.201Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-11640 |
vulnerable | 2026-06-08 06:23:50.052036 |
VikRentCar Car Rental Management System <= 1.4.2 - Cross-Site Request Forgery to Authenticated (Subscriber+) Arbitrary File Upload
HIGH (8.8)
The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.2. This is due to missing or incorrect nonce validation on the 'save' function. This makes it possible for unauthenticated attackers to change plugin access privileges via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Successful exploitation allows attackers with subscriber-level privileges and above to upload arbitrary files on the affected site's server which may make remote code execution possible.
Published: 2025-03-08T11:16:40.090Z
Updated: 2026-04-08T16:50:42.014Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-23998 |
vulnerable | 2026-06-08 05:56:04.962388 |
WordPress VikRentCar Plugin <= 1.3.0 is vulnerable to Cross Site Scripting (XSS)
MEDIUM (5.9)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in E4J s.R.L. VikRentCar Car Rental Management System plugin <= 1.3.0 versions.
Published: 2023-04-06T07:42:52.411Z
Updated: 2026-04-28T16:08:04.952Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.