CVE-2024-10856

The Booking Calendar WpDevArt plugin is vulnerable to time-based, blind SQL injection via the id parameter in the “wpdevartbookingcalendar” shortcode in versions up to, and including, 3.2.19 due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the...

CVE-2024-10856

creationtimestamp| type| source ---|---|--- 2024-12-24 11:11:51+00:00| seen| https://infosec.exchange/users/cve/statuses/113707496962746894 2024-12-24 11:15:33+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3le2cxnxhg62o 2024-12-24 12:43:54+00:00| seen|...

CVE-2024-10856 Booking Calendar WpDevArt <= 3.2.19 - Authenticated (Contributor+) SQL Injection

The Booking Calendar WpDevArt plugin is vulnerable to time-based, blind SQL injection via the id parameter in the “wpdevartbookingcalendar” shortcode in versions up to, and including, 3.2.19 due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the...

CVE-2024-10856

CVE-2024-10856 affects the Booking Calendar WpDevArt plugin for WordPress, up to version 3.2.19. The flaw is a time-based, blind SQL injection via the id parameter in the shortcode wpdevart_booking_calendar, conditioned on the theme option delete_prev_date being enabled. The issue arises from ins...