Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Vendor: Offshore Web Master Clear all filters
TI-2021-06889 CVE-2021-24606 · GHSA-rj93-7769-mc4j

Availability Calendar < 1.2.1 - Authenticated SQL Injection

Priority MEDIUM 41

The Availability Calendar WordPress plugin before 1.2.1 does not escape the category attribute from its shortcode before using it in a SQL statement, leading to a SQL Injection issue, which can be exploited by any user a…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01334 Published 2021-09-20 Fixed in 1.2.1 CWE-89
TI-2021-06887 CVE-2021-24604 · GHSA-p555-vm74-xq5v

Availability Calendar < 1.2.2 - Authenticated Stored Cross-Site Scripting

Priority LOW 23

The Availability Calendar WordPress plugin before 1.2.2 does not sanitise or escape its Category Names before outputting them in page/post where the associated shortcode is embed, allowing high privilege users to perform…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00617 Published 2021-09-20 Fixed in 1.2.2 CWE-79