329 matches found
CVE-2025-2578
The Booking for Appointments and Events Calendar - Amelia plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.2.19 via the 'wpAmeliaApiCall' function. This makes it possible for unauthenticated attackers to retrieve the full path of the web...
CVE-2025-2578
The Booking for Appointments and Events Calendar Amelia plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.2.19 via the 'wpAmeliaApiCall' function. This makes it possible for unauthenticated attackers to retrieve the full path of the web application...
CVE-2025-2578 Booking for Appointments and Events Calendar – Amelia <= 1.2.19 - Unauthenticated Full Path Disclosure
The Booking for Appointments and Events Calendar Amelia plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.2.19 via the 'wpAmeliaApiCall' function. This makes it possible for unauthenticated attackers to retrieve the full path of the web application...
CVE-2025-2578
CVE-2025-2578 (Amelia plugin for Booking/Events Calendar, WordPress) reports a Full Path Disclosure vulnerability in the wpAmeliaApiCall function. Affected: Booking for Appointments and Events Calendar – Amelia for WordPress, versions prior to or equal to 1.2.19. Impact: an unauthenticated attack...
CVE-2025-2578 Booking for Appointments and Events Calendar – Amelia <= 1.2.19 - Unauthenticated Full Path Disclosure
The Booking for Appointments and Events Calendar Amelia plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.2.19 via the 'wpAmeliaApiCall' function. This makes it possible for unauthenticated attackers to retrieve the full path of the web application...
WordPress plugin Booking for Appointments and Events Calendar Amelia 信息泄露漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. An information disclosure...
WordPress Booking for Appointments and Events Calendar – Amelia plugin <= 1.2.19 - Unauthenticated Full Path Disclosure vulnerability
Unauthenticated Full Path Disclosure vulnerability discovered by zhuxuan wu in WordPress Plugin Amelia versions = 1.2.19...
CVE-2025-26965
Authorization Bypass Through User-Controlled Key vulnerability in ameliabooking Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Amelia: from n/a through = 1.2.16...
CVE-2025-26965 WordPress Amelia plugin <= 1.2.16 - Insecure Direct Object References (IDOR) vulnerability
Authorization Bypass Through User-Controlled Key vulnerability in ameliabooking Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Amelia: from n/a through = 1.2.16...
CVE-2025-26965
CVE-2025-26965 is an Auth bypass/IDOR flaw in the Amelia Booking plugin for WordPress (Booking for Appointments & Events Calendar – Amelia). The vulnerability affects the plugin’s cases prior to a patched release (vulnerable range includes
CVE-2025-26965 WordPress Amelia plugin <= 1.2.16 - Insecure Direct Object References (IDOR) vulnerability
Authorization Bypass Through User-Controlled Key vulnerability in ameliabooking Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Amelia: from n/a through = 1.2.16...
PT-2025-7870 · Amelia · Amelia
Name of the Vulnerable Software and Affected Versions: Amelia versions 1.2.16 and earlier Description: The issue affects Amelia due to an Authorization Bypass Through User-Controlled Key vulnerability, which exploits incorrectly configured access control security levels. Recommendations: For...
WordPress plugin Amelia 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...
WordPress Amelia plugin <= 1.2.16 - Insecure Direct Object References (IDOR) vulnerability
Insecure Direct Object References IDOR vulnerability discovered by Revan Arifio Patchstack Alliance in WordPress Plugin Amelia versions = 1.2.16...
CVE-2024-6332
The Booking for Appointments and Events Calendar – Amelia Premium and Lite plugins for WordPress are vulnerable to unauthorized access of data due to a missing capability check on the 'ameliaButtonCommand' function in all versions up to, and including, Premium 7.7 and Lite 1.2.4. This makes it...
CVE-2024-6332
The Booking for Appointments and Events Calendar – Amelia Premium and Lite plugins for WordPress are vulnerable to unauthorized access of data due to a missing capability check on the 'ameliaButtonCommand' function in all versions up to, and including, Premium 7.7 and Lite 1.2.3. This makes it...
CVE-2024-6332
The CVE-2024-6332 entry for Amelia Premium (<=7.7) and Amelia Lite (<=1.2.3) is supported by connected sources indicating a missing capability check in ameliaButtonCommand that allows unauthenticated access to employee calendar details; in the Premium version this also exposes Google Calend...
WordPress Amelia plugin <= 1.2.4 - Missing Authorization to Sensitive Information Exposure vulnerability
Missing Authorization to Sensitive Information Exposure vulnerability discovered by Nadim Zubidat in WordPress Plugin Amelia versions = 1.2.4...
WordPress plugin Amelia 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...
WordPress Amelia Plugin <= 1.2.4 is vulnerable to Broken Access Control
Software Amelia Type Plugin Vulnerable versions = 1.2.4 Fixed in 1.2.5 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-6332 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 338114c15946 Credits Nadim Zubidat Required privilege...