Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Advanced Booking Calendar 1.7.1 Clear all filters
TI-2022-00906 CVE-2022-1007 · GHSA-84jw-8ppw-fjwr

Advanced Booking Calendar < 1.7.1 - Reflected Cross-Site Scripting

Priority LOW 31

The Advanced Booking Calendar WordPress plugin before 1.7.1 does not sanitise and escape the room parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01868 Published 2022-04-11 Fixed in 1.7.1 CWE-79
TI-2022-00905 CVE-2022-1006 · GHSA-wr35-3f65-j6mc

Advanced Booking Calendar < 1.7.1 - Admin+ SQLi

Priority LOW 35

The Advanced Booking Calendar WordPress plugin before 1.7.1 does not sanitise and escape the id parameter when editing Calendars, which could allow high privilege users such as admin to perform SQL injection attacks

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01484 Published 2022-04-11 Fixed in 1.7.1 CWE-89