Car Rental Script Project Car Rental Script — known CVE vulnerabilities

Every CVE whose affected-product data names Car Rental Script Project Car Rental Script, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (8)

• CVE-2017-17637 — CVSS 9.8 (critical): Car Rental Script 2.0.4 has SQL Injection via the countrycode1.php val parameter.
• CVE-2017-17906 — CVSS 9.8 (critical): PHP Scripts Mall Car Rental Script has SQL Injection via the admin/carlistedit.php carid parameter.
• CVE-2018-20648 — CVSS 8.8 (high): PHP Scripts Mall Car Rental Script 2.0.8 has Cross-Site Request Forgery (CSRF) via accountedit.php.
• CVE-2017-17905 — CVSS 8.8 (high): PHP Scripts Mall Car Rental Script has CSRF via admin/sitesettings.php.
• CVE-2018-20647 — CVSS 6.5 (medium): PHP Scripts Mall Car Rental Script 2.0.8 has directory traversal via a direct request for a listing of an image directory such as an…
• CVE-2017-17907 — CVSS 6.1 (medium): PHP Scripts Mall Car Rental Script has XSS via the admin/areaedit.php carid parameter or the admin/sitesettings.php websitename parameter.
• CVE-2018-6904 — CVSS 5.4 (medium): PHP Scripts Mall Car Rental Script 2.0.8 has XSS via the User Name field in an Edit Profile action.
• CVE-2018-15182 — CVSS 5.4 (medium): PHP Scripts Mall Car Rental Script 2.0.8 has XSS via the FirstName and LastName fields.