Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: Amelia – Events & Appointments Booking Calendar 1.0.47 Clear all filters
TI-2022-00601 CVE-2022-0687 · GHSA-588c-3c3h-7vcq

Amelia < 1.0.46 - Manager+ RCE

Priority MEDIUM 41

The Amelia WordPress plugin before 1.0.47 stores image blobs into actual files whose extension is controlled by the user, which may lead to PHP backdoors being uploaded onto the site.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01462 Published 2022-03-21 Fixed in 1.0.47 CWE-434
TI-2022-00544 CVE-2022-0627 · GHSA-pq9j-7g2h-8845

Amelia < 1.0.46 - Reflected Cross-Site Scripting

Priority LOW 29

The Amelia WordPress plugin before 1.0.47 does not sanitize and escape the code parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.008 Published 2022-03-21 Fixed in 1.0.47 CWE-79
TI-2022-00533 CVE-2022-0616 · GHSA-chqh-f22c-h6qc

Amelia < 1.0.46 - Arbitrary Customer Deletion via CSRF

Priority LOW 20

The Amelia WordPress plugin before 1.0.47 does not have CSRF check in place when deleting customers, which could allow attackers to make a logged in admin delete arbitrary customers via a CSRF attack

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00435 Published 2022-03-21 Fixed in 1.0.47 CWE-352