Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

8 records

Vendor: wpdevart Component: Booking Calendar Clear all filters
TI-2024-10064 CVE-2024-10856 · GHSA-cq77-jhpm-mjmj

Booking Calendar WpDevArt <= 3.2.19 - Authenticated (Contributor+) SQL Injection

Priority LOW 29

The Booking Calendar WpDevArt plugin is vulnerable to time-based, blind SQL injection via the `id` parameter in the “wpdevart_booking_calendar” shortcode in versions up to, and including, 3.2.19 due to insufficient escap…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00493 Published 2024-12-24 No fix listed CWE-89
TI-2023-10029 CVE-2023-24407 · GHSA-vm52-xw7f-3537

WordPress Booking calendar, Appointment Booking System plugin <= 3.2.3 - Broken Access Control vulnerability

Priority LOW 39

Missing Authorization vulnerability in WpDevArt Booking calendar, Appointment Booking System allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking calendar, Appointment Bookin…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00501 Published 2024-12-09 No fix listed CWE-862
TI-2023-09995 CVE-2023-24373 · GHSA-x838-jxp7-m9m8

WordPress Booking calendar, Appointment Booking System plugin <= 3.2.3 - Bypass vulnerability

Priority MEDIUM 42

External Control of Assumed-Immutable Web Parameter vulnerability in WpDevArt Booking calendar, Appointment Booking System allows Manipulating Hidden Fields.This issue affects Booking calendar, Appointment Booking System…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00354 Published 2024-06-03 No fix listed CWE-472
TI-2022-23505 CVE-2022-47428 · GHSA-vp68-65xj-g24v

WordPress Booking calendar, Appointment Booking System Plugin <= 3.2.7 is vulnerable to SQL Injection

Priority MEDIUM 50

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WpDevArt Booking calendar, Appointment Booking System allows SQL Injection.This issue affects Booking calendar, Appoin…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00681 Published 2023-11-06 No fix listed CWE-89
TI-2022-03651 CVE-2022-3982 · GHSA-7v4v-c3pr-fgrq

Booking Calendar < 3.2.2 - Unauthenticated Arbitrary File Upload

Priority HIGH 82

The Booking calendar, Appointment Booking System WordPress plugin before 3.2.2 does not validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as PHP and achieve RCE

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.04809 Published 2022-12-12 Fixed in 3.2.2