297 matches found
CVE-2026-14214
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.4 does not restrict which fields can be written through its customer import, allowing a user with the Amelia Manager role to modify arbitrary columns of any stored user record by supplying them in the import request...
CVE-2026-14214
The CVE concerns the Booking for Appointments and Events Calendar WordPress plugin (pre-2.4.4). The root cause is that the customer import does not restrict which fields can be written, allowing an Amelia Manager to arbitrarily modify columns in stored user records via the import request. This yi...
CVE-2026-14214 Amelia < 2.4.4 - Amelia Manager+ Arbitrary User-Field Modification via Mass Assignment
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.4 does not restrict which fields can be written through its customer import, allowing a user with the Amelia Manager role to modify arbitrary columns of any stored user record by supplying them in the import request...
CVE-2026-14214
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.4 does not restrict which fields can be written through its customer import, allowing a user with the Amelia Manager role to modify arbitrary columns of any stored user record by supplying them in the import request...
EUVD-2026-51705
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.4 does not restrict which fields can be written through its customer import, allowing a user with the Amelia Manager role to modify arbitrary columns of any stored user record by supplying them in the import request...
WordPress Booking for Appointments and Events Calendar plugin < 2.4.4 - Amelia Manager+ Arbitrary User-Field Modification vulnerability
Amelia Manager+ Arbitrary User-Field Modification vulnerability discovered by Manuel Martínez Casasola in WordPress Plugin Amelia versions 2.4.4...
CVE-2026-14782
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to SQL Injection via the Customer Import in all versions up to, and including, 2.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL quer...
CVE-2026-14782 Booking for Appointments and Events Calendar – Amelia <= 2.4.3 - Authenticated (Custom+) SQL Injection via Customer Import
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to SQL Injection via the Customer Import in all versions up to, and including, 2.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL quer...
CVE-2026-14782
The CVE-2026-14782 entry concerns the Booking for Appointments and Events Calendar – Amelia plugin for WordPress. A SQL Injection exists via the Customer Import feature in all versions up to and including 2.4.3, due to insufficient escaping of the user-supplied parameter and inadequate preparatio...
PT-2026-60589
Name of the Vulnerable Software and Affected Versions Booking for Appointments and Events Calendar – Amelia versions prior to 2.4.4 Description An issue exists in the Customer Import feature where insufficient escaping of user-supplied parameters and a lack of proper preparation of SQL queries...
CVE-2026-57702
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Melograno Venture Studio Amelia ameliabooking allows Blind SQL Injection.This issue affects Amelia: from n/a through = 2.4.2...
CVE-2026-57702
The WordPress Amelia plugin (Amelia ameliabooking)
CVE-2026-57702 WordPress Amelia plugin <= 2.4.2 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Melograno Venture Studio Amelia ameliabooking allows Blind SQL Injection.This issue affects Amelia: from n/a through = 2.4.2...
WordPress Amelia plugin <= 2.4.2 - SQL Injection vulnerability
SQL Injection vulnerability discovered by daroo in WordPress Plugin Amelia versions = 2.4.2...
EUVD-2026-36998
Subscriber Broken Access Control in Amelia = 2.2 versions...
EUVD-2026-36992
Unauthenticated Sensitive Data Exposure in Amelia = 2.2 versions...
CVE-2026-48889
Subscriber Privilege Escalation in Amelia = 2.3 versions...
CVE-2026-40789
Unauthenticated Sensitive Data Exposure in Amelia = 2.2 versions...