https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2023-48837.htmlhttps://patchthecve.com/cve/CVE-2023-48837.htmlWed, 17 Jun 2026 06:35:03 +0000MEDIUM 5.4: Car Rental Script 3.0 is vulnerable to Multiple HTML Injection issues via SMS API Key or Default Country Code.https://patchthecve.com/cve/CVE-2023-48836.htmlhttps://patchthecve.com/cve/CVE-2023-48836.htmlWed, 17 Jun 2026 06:35:03 +0000MEDIUM 5.4: Car Rental Script 3.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) issues via the name, plugin_sms_api_key, plugin_sms_country_code, calendar_id, title, country name, or customer_name parameter.https://patchthecve.com/cve/CVE-2023-48835.htmlhttps://patchthecve.com/cve/CVE-2023-48835.htmlWed, 17 Jun 2026 06:35:03 +0000HIGH 8.8: Car Rental Script v3.0 is vulnerable to CSV Injection via a Language > Labels > Export action.https://patchthecve.com/cve/CVE-2023-48834.htmlhttps://patchthecve.com/cve/CVE-2023-48834.htmlWed, 17 Jun 2026 06:35:03 +0000HIGH 7.5: A lack of rate limiting in pjActionAjaxSend in Car Rental v3.0 allows attackers to cause resource exhaustion.https://patchthecve.com/cve/CVE-2023-40764.htmlhttps://patchthecve.com/cve/CVE-2023-40764.htmlWed, 17 Jun 2026 06:19:25 +0000CRITICAL 9.8: User enumeration is found in PHP Jabbers Car Rental Script v3.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.https://patchthecve.com/cve/CVE-2023-40754.htmlhttps://patchthecve.com/cve/CVE-2023-40754.htmlWed, 17 Jun 2026 06:19:22 +0000HIGH 8.8: In PHPJabbers Car Rental Script 3.0, lack of verification when changing an email address and/or password (on the Profile Page) allows remote attackers to take over accounts.https://patchthecve.com/cve/CVE-2018-20648.htmlhttps://patchthecve.com/cve/CVE-2018-20648.htmlWed, 17 Jun 2026 01:53:15 +0000HIGH 8.8: PHP Scripts Mall Car Rental Script 2.0.8 has Cross-Site Request Forgery (CSRF) via accountedit.php.https://patchthecve.com/cve/CVE-2018-20647.htmlhttps://patchthecve.com/cve/CVE-2018-20647.htmlWed, 17 Jun 2026 01:53:15 +0000MEDIUM 6.5: PHP Scripts Mall Car Rental Script 2.0.8 has directory traversal via a direct request for a listing of an image directory such as an images/ directory.https://patchthecve.com/cve/CVE-2018-15182.htmlhttps://patchthecve.com/cve/CVE-2018-15182.htmlWed, 17 Jun 2026 01:42:11 +0000MEDIUM 5.4: PHP Scripts Mall Car Rental Script 2.0.8 has XSS via the FirstName and LastName fields.https://patchthecve.com/cve/CVE-2018-6904.htmlhttps://patchthecve.com/cve/CVE-2018-6904.htmlWed, 17 Jun 2026 02:02:26 +0000MEDIUM 5.4: PHP Scripts Mall Car Rental Script 2.0.8 has XSS via the User Name field in an Edit Profile action.https://patchthecve.com/cve/CVE-2017-17907.htmlhttps://patchthecve.com/cve/CVE-2017-17907.htmlWed, 17 Jun 2026 01:11:52 +0000MEDIUM 6.1: PHP Scripts Mall Car Rental Script has XSS via the admin/areaedit.php carid parameter or the admin/sitesettings.php websitename parameter.https://patchthecve.com/cve/CVE-2017-17906.htmlhttps://patchthecve.com/cve/CVE-2017-17906.htmlWed, 17 Jun 2026 01:11:52 +0000CRITICAL 9.8: PHP Scripts Mall Car Rental Script has SQL Injection via the admin/carlistedit.php carid parameter.https://patchthecve.com/cve/CVE-2017-17905.htmlhttps://patchthecve.com/cve/CVE-2017-17905.htmlWed, 17 Jun 2026 01:11:52 +0000HIGH 8.8: PHP Scripts Mall Car Rental Script has CSRF via admin/sitesettings.php.https://patchthecve.com/cve/CVE-2017-17637.htmlhttps://patchthecve.com/cve/CVE-2017-17637.htmlWed, 17 Jun 2026 01:11:25 +0000CRITICAL 9.8: Car Rental Script 2.0.4 has SQL Injection via the countrycode1.php val parameter.