CVE-2020-24313

Etoile Web Design Ultimate Appointment Booking & Scheduling WordPress Plugin v1.1.9 and lower does not sanitize the value of the "AppointmentID" GET parameter before echoing it back out inside an input tag. This results in a reflected XSS vulnerability that attackers can exploit with a specially...

CVE-2020-24313

Etoile Web Design Ultimate Appointment Booking & Scheduling WordPress Plugin v1.1.9 and lower does not sanitize the value of the "AppointmentID" GET parameter before echoing it back out inside an input tag. This results in a reflected XSS vulnerability that attackers can exploit with a specially...

CVE-2020-24313

CVE-2020-24313 affects Etoile Web Design Ultimate Appointment Booking & Scheduling WordPress Plugin (versions 1.1.9 and lower). The issue is a reflected XSS in which the GET parameter Appointment_ID is echoed back inside an input tag without sanitization, enabling attacker-controlled script via a...

PT-2020-15678 · Etoile Web Design · Etoile Web Design Ultimate Appointment Booking & Scheduling Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Etoile Web Design Ultimate Appointment Booking & Scheduling WordPress Plugin versions 1.1.9 and lower Description: The issue is related to a reflected XSS vulnerability. It occurs because the Appointment ID GET parameter value is not properly...

Service Update 0.15 for Microsoft Dynamics 365 9.0

None None...

Ultimate Appointment Booking & Scheduling < 1.1.10 - Authenticated Cross-Site Scripting (XSS)

The Ultimate Appointment Booking & Scheduling WordPress plugin, versions 1.1.9 and older, were vulnerable to Authenticated Cross-Site Scripting XSS within multiple parameters...

SQL Injection Vulnerability in Online Appointment Registration System of Shandong Bailing Health Consulting Co.

Shandong Bailing Health Consulting Co., Ltd. is a high-tech software enterprise with independent research and development capabilities in the main business areas of health consulting, and software research and development, design, development, sales, training and service integration of informatio...

Information Leakage Vulnerability in the Appointment Registration System of Nanjing Medical Healthcare Information Technology Co.

Ltd. is a high-tech growing enterprise in China Nanjing Software Valley. Nanjing Medical Healthcare Appointment and Registration System has the features of unified number pool for internal and external networks, multi-appointment channels, registration and appointment to the point of time,...

Timezone on Clients Running Windows 10 Changes in Citrix VDI from US-EDT to "Caracas" time

Current Timezone is UTC - 05:00 US & Canada - When end users log into a Citrix VDI Windows 7 desktop using a Windows 10 client/host the timezone switches to UTC - 04:00 Caracas. This causes problem with Calendar appointments getting booked in the wrong time zone and being 1/2 hour behind. If we...

WordPress Appointment Booking Calendar 1.3.34 CSV Injection

Exploit Title: Wordpress Plugin Appointment Booking Calendar 1.3.34 - CSV Injection Google Dork: N/A Date: 2020-03-05 Exploit Author: Daniel Monzón stark0de Vendor Homepage: https://www.codepeople.net/ Software Link: https://downloads.wordpress.org/plugin/appointment-booking-calendar.zip Version:...

WordPress Plugin Appointment Booking Calendar 1.3.34 - CSV Injection

Exploit Title: Wordpress Plugin Appointment Booking Calendar 1.3.34 - CSV Injection Google Dork: N/A Date: 2020-03-05 Exploit Author: Daniel Monzón stark0de Vendor Homepage: https://www.codepeople.net/ Software Link: https://downloads.wordpress.org/plugin/appointment-booking-calendar.zip Version:...

Wordpress Plugin Appointment Booking Calendar 1.3.34 - CSV Injection

Wordpress Plugin Appointment Booking Calendar 1.3.34 - CSV Injection Exploit Title: Wordpress Plugin Appointment Booking Calendar 1.3.34 - CSV Injection Google Dork: N/A Date: 2020-03-05 Exploit Author: Daniel Monzón stark0de Vendor Homepage: https://www.codepeople.net/ Software Link:...

WordPress Appointment Booking Calendar <= 1.3.34 - CSV Injection vulnerability

CSV Injection vulnerability discovered by Daniel Monzon in WordPress Appointment Booking Calendar plugin versions = 1.3.34. Solution Update the WordPress Appointment Booking Calendar to the latest available version at least 1.3.35...

WordPress Appointment Booking Calendar plugin <= 1.3.34 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Daniel Monzon in WordPress Appointment Booking Calendar plugin versions = 1.3.34. Solution Update the WordPress Appointment Booking Calendar plugin to the latest available version at least 1.3.35...

CVE-2020-9372

The Appointment Booking Calendar plugin before 1.3.35 for WordPress allows user input in fields such as Description or Name in any booking form to be any formula, which then could be exported via the Bookings list tab in /wp-admin/admin.php?page=cpabcappointments.php. The attacker could achieve...

CVE-2020-9371

Stored XSS exists in the Appointment Booking Calendar plugin before 1.3.35 for WordPress. In the cpabcappointments.php file, the Calendar Name input could allow attackers to inject arbitrary JavaScript or HTML...

CVE-2020-9371

Stored XSS exists in the Appointment Booking Calendar plugin before 1.3.35 for WordPress. In the cpabcappointments.php file, the Calendar Name input could allow attackers to inject arbitrary JavaScript or HTML...

CVE-2020-9371

Stored XSS exists in the Appointment Booking Calendar plugin before 1.3.35 for WordPress. In the cpabcappointments.php file, the Calendar Name input could allow attackers to inject arbitrary JavaScript or HTML...

Input validation

The Appointment Booking Calendar plugin before 1.3.35 for WordPress allows user input in fields such as Description or Name in any booking form to be any formula, which then could be exported via the Bookings list tab in /wp-admin/admin.php?page=cpabcappointments.php. The attacker could achieve...

Cross site scripting

Stored XSS exists in the Appointment Booking Calendar plugin before 1.3.35 for WordPress. In the cpabcappointments.php file, the Calendar Name input could allow attackers to inject arbitrary JavaScript or HTML...