CVE-2024-31425 WordPress Amelia plugin <= 1.0.95 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in TMS Amelia.This issue affects Amelia: from n/a through 1.0.95...

CVE-2024-31425 WordPress Amelia plugin <= 1.0.95 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in TMS Amelia.This issue affects Amelia: from n/a through 1.0.95...

PT-2024-24066 · Unknown · Tms Amelia

Name of the Vulnerable Software and Affected Versions: TMS Amelia versions 1.0.95 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the software. This type of issue allows an attacker to trick a user into performing unintended actions on a web application that the user is...

WordPress Amelia plugin <= 1.0.95 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Yudistira Arya Patchstack Alliance in WordPress Plugin Amelia versions = 1.0.95...

WordPress Amelia Plugin <= 1.0.95 is vulnerable to Cross Site Request Forgery (CSRF)

Software Amelia Type Plugin Vulnerable versions = 1.0.95 Fixed in 1.0.96 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-31425 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 24abe35a417b Credits Yudistira Arya Required...

CVE-2024-1484 Booking for Appointments and Events Calendar – Amelia <= 1.0.98 - Reflected Cross-Site Scripting

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the date parameters in all versions up to, and including, 1.0.98 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticate...

CVE-2024-1484

CVE-2024-1484 — Amelia plugin for WordPress (Booking for Appointments and Events Calendar) Vulnerability type: Reflected Cross-Site Scripting (XSS) via date parameters in the plugin’s input handling. Root cause: Insufficient input sanitization and output escaping allows injection of arbitrary web...

WordPress Amelia Plugin <= 1.0.98 is vulnerable to Cross Site Scripting (XSS)

Software Amelia Type Plugin Vulnerable versions = 1.0.98 Fixed in 1.0.99 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1484 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 28e85735d453 Credits Muhammad Hassham Nagori...

Booking for Appointments and Events Calendar – Amelia < 1.0.99 - Reflected Cross-Site Scripting

Description The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the date parameters in all versions up to, and including, 1.0.98 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2023-6808

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 1.0.93 due to insufficient input sanitization and output escaping on user supplied attributes. This makes i...

CVE-2023-6808 Booking for Appointments and Events Calendar – Amelia <= 1.0.93 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 1.0.93 due to insufficient input sanitization and output escaping on user supplied attributes. This makes i...

CVE-2023-6808

CVE-2023-6808 affects the WordPress plugin “Booking for Appointments and Events Calendar – Amelia.” The issue is stored cross-site scripting via the plugin’s shortcode attributes due to insufficient input sanitization and output escaping on user-supplied data. It can allow authenticated attackers...

Amelia < 1.0.99 - Missing Authorization

Description The plugin is vulnerable to unauthorized access due to a missing capability check on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action...

Booking for Appointments and Events Calendar – Amelia < 1.0.94 - Contributor+ Stored Cross-Site Scripting via shortcode

Description The plugin is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 1.0.93 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...

WordPress Amelia Plugin <= 1.0.93 is vulnerable to Cross Site Scripting (XSS)

Software Amelia Type Plugin Vulnerable versions = 1.0.93 Fixed in 1.0.94 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-6808 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 16e403f44329 Credits Ngô Thiên An ancorn Required...

WordPress Amelia Plugin <= 1.0.98 is vulnerable to Broken Access Control

Software Amelia Type Plugin Vulnerable versions = 1.0.98 Fixed in 1.0.99 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-22298 Patch priority Medium CVSS severity Medium 5.3 Developer Claim ownership PSID 1d2002f1be74 Credits Abdi Pranata Required privileg...

Booking for Appointments and Events Calendar – Amelia < 1.0.86 - Contributor+ Stored XSS

Description The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

WordPress Booking for Appointments and Events Calendar - Amelia Plugin < 1.0.86 XSS Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:tms-outsource:amelia"; if description...

CVE-2023-50860

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in TMS Booking for Appointments and Events Calendar – Amelia allows Stored XSS.This issue affects Booking for Appointments and Events Calendar – Amelia: from n/a through 1.0.85...

CVE-2023-50860

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in TMS Booking for Appointments and Events Calendar – Amelia allows Stored XSS.This issue affects Booking for Appointments and Events Calendar – Amelia: from n/a through 1.0.85...