Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 7

Export CSV
CVE-2022-45824

WordPress Advanced Booking Calendar Plugin <= 1.7.1 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in Advanced Booking Calendar plugin <= 1.7.1 on WordPress.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Elbtide
Products
Advanced Booking Calendar
CVE-2022-45822

WordPress Advanced Booking Calendar Plugin <= 1.7.1 is vulnerable to SQL Injection

Unauth. SQL Injection (SQLi) vulnerability in Advanced Booking Calendar plugin <= 1.7.1 on WordPress.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Elbtide
Products
Advanced Booking Calendar
CVE-2022-1007

Advanced Booking Calendar < 1.7.1 - Reflected Cross-Site Scripting

The Advanced Booking Calendar WordPress plugin before 1.7.1 does not sanitise and escape the room parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue

CVSS 3.1 · 6.1 Medium EPSS 1.9% KEV · Not listed
Vendors
Elbtide
Products
Advanced Booking Calendar
CVE-2022-1006

Advanced Booking Calendar < 1.7.1 - Admin+ SQLi

The Advanced Booking Calendar WordPress plugin before 1.7.1 does not sanitise and escape the id parameter when editing Calendars, which could allow high privilege users such as admin to perform SQL injection attacks

CVSS 3.1 · 7.2 High EPSS 1.5% KEV · Not listed
Vendors
Elbtide
Products
Advanced Booking Calendar
CVE-2022-0694

Advanced Booking Calendar < 1.7.0 - Unauthenticated SQL Injection

The Advanced Booking Calendar WordPress plugin before 1.7.0 does not validate and escape the calendar parameter before using it in a SQL statement via the abc_booking_getSingleCalendar AJAX action (available to both unauthenticated and authenticated users), leading to an unauthenticated SQL injection

CVSS 3.1 · 9.8 Critical EPSS 1.8% KEV · Not listed
Vendors
Elbtide
Products
Advanced Booking Calendar
CVE-2021-24232

Advanced Booking Calendar < 1.6.8 - Authenticated Reflected Cross-Site Scripting (XSS)

The Advanced Booking Calendar WordPress plugin before 1.6.8 does not sanitise the license error message when output in the settings page, leading to an authenticated reflected Cross-Site Scripting issue

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Elbtide
Products
Advanced Booking Calendar
CVE-2021-24225

Advanced Booking Calendar < 1.6.7 - Authenticated Reflected Cross-Site Scripting (XSS)

The Advanced Booking Calendar WordPress plugin before 1.6.7 did not sanitise the calId GET parameter in the "Seasons & Calendars" page before outputing it in an A tag, leading to a reflected XSS issue

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Elbtide
Products
Advanced Booking Calendar