CVE-2024-6332

The CVE-2024-6332 entry for Amelia Premium (<=7.7) and Amelia Lite (<=1.2.3) is supported by connected sources indicating a missing capability check in ameliaButtonCommand that allows unauthenticated access to employee calendar details; in the Premium version this also exposes Google Calend...

WordPress Amelia Plugin <= 1.2.4 is vulnerable to Broken Access Control

Software Amelia Type Plugin Vulnerable versions = 1.2.4 Fixed in 1.2.5 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-6332 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 338114c15946 Credits Nadim Zubidat Required privilege...

CVE-2024-6552 Booking for Appointments and Events Calendar – Amelia <= 1.2 - Unauthenticated Full Path Disclosure

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.2. This is due to the plugin utilizing Symfony and leaving displayerrors on within test files. This makes it possible for unauthenticated...

WordPress Amelia Plugin <= 1.2 is vulnerable to Sensitive Data Exposure

Software Amelia Type Plugin Vulnerable versions = 1.2 Fixed in 1.2.1 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-6552 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 963ab0b19e24 Credits stealthcopter Required privilege...

WordPress plugin Amelia 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

WordPress Amelia plugin <= 1.1.8 - Malicious Polyfill.io Embed vulnerability

Malicious Polyfill.io Embed vulnerability discovered by Sansec.io in WordPress Plugin Amelia versions = 1.1.8...

WordPress Amelia Plugin <= 1.1.8 is vulnerable to Backdoor

Software Amelia Type Plugin Vulnerable versions = 1.1.8 Fixed in 1.1.9 OWASP Top 10 A3: Injection Classification Backdoor CVE N/A Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 9adf81355a51 Credits Sansec.io Required privilege Unauthenticated Published 3 July, 2024...

CVE-2024-6225

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.1.5 and 7.5.1 for the Pro version due to insufficient input sanitization and output escaping. This makes it possib...

WordPress Amelia Plugin <= 1.1.5 is vulnerable to Cross Site Scripting (XSS)

Software Amelia Type Plugin Vulnerable versions = 1.1.5 Fixed in 1.1.6 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-6225 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 7d613d3e00ad Credits Vinay Kumar Required privilege Administrator...

CVE-2024-22298 WordPress Amelia plugin <= 1.0.98 - Broken Access Control vulnerability

Missing Authorization vulnerability in TMS Amelia ameliabooking.This issue affects Amelia: from n/a through 1.0.98...

Amelia < 1.0.96 - Cross-Site Request Forgery

Description The Amelia plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.95. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged...

CVE-2024-31425 WordPress Amelia plugin <= 1.0.95 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in TMS Amelia.This issue affects Amelia: from n/a through 1.0.95...

WordPress Amelia plugin <= 1.0.95 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Yudistira Arya Patchstack Alliance in WordPress Plugin Amelia versions = 1.0.95...

WordPress Amelia Plugin <= 1.0.95 is vulnerable to Cross Site Request Forgery (CSRF)

Software Amelia Type Plugin Vulnerable versions = 1.0.95 Fixed in 1.0.96 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-31425 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 24abe35a417b Credits Yudistira Arya Required...

CVE-2024-1484 Booking for Appointments and Events Calendar – Amelia <= 1.0.98 - Reflected Cross-Site Scripting

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the date parameters in all versions up to, and including, 1.0.98 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticate...

CVE-2024-1484

CVE-2024-1484 — Amelia plugin for WordPress (Booking for Appointments and Events Calendar) Vulnerability type: Reflected Cross-Site Scripting (XSS) via date parameters in the plugin’s input handling. Root cause: Insufficient input sanitization and output escaping allows injection of arbitrary web...

WordPress Amelia Plugin <= 1.0.98 is vulnerable to Cross Site Scripting (XSS)

Software Amelia Type Plugin Vulnerable versions = 1.0.98 Fixed in 1.0.99 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1484 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 28e85735d453 Credits Muhammad Hassham Nagori...

CVE-2023-6808

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 1.0.93 due to insufficient input sanitization and output escaping on user supplied attributes. This makes i...

CVE-2023-6808

CVE-2023-6808 affects the WordPress plugin “Booking for Appointments and Events Calendar – Amelia.” The issue is stored cross-site scripting via the plugin’s shortcode attributes due to insufficient input sanitization and output escaping on user-supplied data. It can allow authenticated attackers...

Amelia < 1.0.99 - Missing Authorization

Description The plugin is vulnerable to unauthorized access due to a missing capability check on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action...