Lucene search

K
ElbtideAdvanced Booking Calendar

7 matches found

CVE
CVE
added 2022/03/21 7:15 p.m.78 views

CVE-2022-0694

The Advanced Booking Calendar WordPress plugin before 1.7.0 does not validate and escape the calendar parameter before using it in a SQL statement via the abc_booking_getSingleCalendar AJAX action (available to both unauthenticated and authenticated users), leading to an unauthenticated SQL injecti...

9.8CVSS9.8AI score0.00907EPSS
CVE
CVE
added 2022/04/11 3:15 p.m.74 views

CVE-2022-1007

The Advanced Booking Calendar WordPress plugin before 1.7.1 does not sanitise and escape the room parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue

6.1CVSS6AI score0.0204EPSS
CVE
CVE
added 2022/04/11 3:15 p.m.68 views

CVE-2022-1006

The Advanced Booking Calendar WordPress plugin before 1.7.1 does not sanitise and escape the id parameter when editing Calendars, which could allow high privilege users such as admin to perform SQL injection attacks

7.2CVSS7.2AI score0.00588EPSS
CVE
CVE
added 2022/12/05 12:15 p.m.42 views

CVE-2022-45824

Cross-Site Request Forgery (CSRF) vulnerability in Advanced Booking Calendar plugin

6.5CVSS6.1AI score0.00047EPSS
CVE
CVE
added 2022/12/05 11:15 a.m.41 views

CVE-2022-45822

Unauth. SQL Injection (SQLi) vulnerability in Advanced Booking Calendar plugin

10CVSS10AI score0.00207EPSS
CVE
CVE
added 2021/04/22 9:15 p.m.39 views

CVE-2021-24232

The Advanced Booking Calendar WordPress plugin before 1.6.8 does not sanitise the license error message when output in the settings page, leading to an authenticated reflected Cross-Site Scripting issue

5.4CVSS5.2AI score0.00188EPSS
CVE
CVE
added 2021/04/12 2:15 p.m.38 views

CVE-2021-24225

The Advanced Booking Calendar WordPress plugin before 1.6.7 did not sanitise the calId GET parameter in the "Seasons & Calendars" page before outputing it in an A tag, leading to a reflected XSS issue

5.4CVSS5.2AI score0.00162EPSS