Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
195 results · page 4 of 4
Aug 3, 2023PHPJabbers Availability Booking Calendar 5.0 is vulnerable to User Account Takeover through username/password change.CVE-2023-36133 · Websites & servers · Phpjabbers · reported by MITRECritical 9.8
PHPJabbers Availability Booking Calendar 5.0 is vulnerable to User Account Takeover through username/password change.
- Product
- Availability Booking Calendar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmedium.comphpjabbers.com
Aug 3, 2023PHP Jabbers Availability Booking Calendar 5.0 is vulnerable to Incorrect Access Control.CVE-2023-36132 · Websites & servers · Phpjabbers · reported by MITRECritical 9.8
PHP Jabbers Availability Booking Calendar 5.0 is vulnerable to Incorrect Access Control.
- Product
- Availability Booking Calendar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmedium.comphpjabbers.com
Aug 3, 2023PHPJabbers Availability Booking Calendar 5.0 is vulnerable to Incorrect Access Control due to improper input validation of password parameter.CVE-2023-36131 · Websites & servers · Phpjabbers · reported by MITRECritical 9.8
PHPJabbers Availability Booking Calendar 5.0 is vulnerable to Incorrect Access Control due to improper input validation of password parameter.
- Product
- Availability Booking Calendar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmedium.comphpjabbers.com
Aug 2, 2023A vulnerability has been found in PHP Jabbers Availability Booking Calendar 5.0 and classified as problematic.CVE-2023-4110 · Websites & servers · PHP Jabbers · reported by VulDBLow 3.5
A vulnerability has been found in PHP Jabbers Availability Booking Calendar 5.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /index.php. The manipulation of the argument session_id leads to cross site scripting. The attack can be launched remotely. The identifier VDB-235957 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Availability Booking Calendar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comvuldb.com
Aug 1, 2023There is a Cross Site Scripting (XSS) vulnerability in the "theme" parameter of preview.php in PHPJabbers Time Slots Booking Calendar v3.3.CVE-2023-33564 · Websites & servers · Phpjabbers · reported by MITREMedium 6.1
There is a Cross Site Scripting (XSS) vulnerability in the "theme" parameter of preview.php in PHPJabbers Time Slots Booking Calendar v3.3.
- Product
- Time Slots Booking Calendar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmedium.comphpjabbers.com
Aug 1, 2023In PHP Jabbers Time Slots Booking Calendar 3.3 , lack of verification when changing an email address and/or password (on the Profile Page) allows remote attackeCVE-2023-33563 · Websites & servers · Phpjabbers · reported by MITREHigh 8.8
In PHP Jabbers Time Slots Booking Calendar 3.3 , lack of verification when changing an email address and/or password (on the Profile Page) allows remote attackers to take over accounts.
- Product
- Time Slots Booking Calendar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmedium.comphpjabbers.com
Aug 1, 2023User enumeration is found in in PHP Jabbers Time Slots Booking Calendar v3.3.CVE-2023-33562 · Websites & servers · Phpjabbers · reported by MITRECritical 9.8
User enumeration is found in in PHP Jabbers Time Slots Booking Calendar v3.3. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
- Product
- Time Slots Booking Calendar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmedium.comphpjabbers.com
Aug 1, 2023Improper input validation of password parameter in PHP Jabbers Time Slots Booking Calendar v 3.3 results in insecure passwords.CVE-2023-33561 · Websites & servers · Phpjabbers · reported by MITRECritical 9.8
Improper input validation of password parameter in PHP Jabbers Time Slots Booking Calendar v 3.3 results in insecure passwords.
- Product
- Time Slots Booking Calendar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmedium.comphpjabbers.com
Aug 1, 2023There is a Cross Site Scripting (XSS) vulnerability in "cid" parameter of preview.php in PHPJabbers Time Slots Booking Calendar v3.3.CVE-2023-33560 · Websites & servers · Phpjabbers · reported by MITREMedium 6.1
There is a Cross Site Scripting (XSS) vulnerability in "cid" parameter of preview.php in PHPJabbers Time Slots Booking Calendar v3.3.
- Product
- Time Slots Booking Calendar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmedium.comphpjabbers.com
Jul 27, 2023A vulnerability, which was classified as problematic, was found in GZ Scripts Availability Booking Calendar PHP 1.0.CVE-2023-3970 · Other software · GZ Scripts · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in GZ Scripts Availability Booking Calendar PHP 1.0. This affects an unknown part of the file /index.php?controller=GzUser&action=edit&id=1 of the component Image Handler. The manipulation of the argument img leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-235569 was assigned to this vulnerability.
- Product
- Availability Booking Calendar PHP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 27, 2023A vulnerability, which was classified as problematic, has been found in GZ Scripts Availability Booking Calendar PHP 1.0.CVE-2023-3969 · Other software · GZ Scripts · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in GZ Scripts Availability Booking Calendar PHP 1.0. Affected by this issue is some unknown functionality of the file index.php of the component HTTP POST Request Handler. The manipulation of the argument promo_code leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-235568.
- Product
- Availability Booking Calendar PHP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2023A vulnerability classified as problematic has been found in GZ Scripts Event Booking Calendar 1.8.CVE-2023-3558 · Other software · GZ Scripts · reported by VulDBLow 3.5
A vulnerability classified as problematic has been found in GZ Scripts Event Booking Calendar 1.8. Affected is an unknown function of the file /load.php. The manipulation of the argument first_name/second_name/phone/address_1/country leads to cross site scripting. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-233352. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Event Booking Calendar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2023A vulnerability was found in GZ Scripts Time Slot Booking Calendar PHP 1.8.CVE-2023-3544 · Other software · GZ Scripts · reported by VulDBLow 3.5
A vulnerability was found in GZ Scripts Time Slot Booking Calendar PHP 1.8. It has been declared as problematic. This vulnerability affects unknown code of the file /load.php. The manipulation of the argument first_name/second_name/phone/address_1/country leads to cross site scripting. The attack can be initiated remotely. The identifier of this vulnerability is VDB-233296. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Time Slot Booking Calendar PHP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2023A vulnerability was found in GZ Scripts Availability Booking Calendar PHP 1.8.CVE-2023-3543 · Other software · GZ Scripts · reported by VulDBLow 3.5
A vulnerability was found in GZ Scripts Availability Booking Calendar PHP 1.8. It has been classified as problematic. This affects an unknown part of the file load.php of the component HTTP POST Request Handler. The manipulation of the argument cid/first_name/second_name/address_1/country leads to cross site scripting. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-233295. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Availability Booking Calendar PHP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2023Cross-Site Request Forgery (CSRF) vulnerability in Booking Ultra Pro Appointments Booking Calendar Plugin plugin <= 1.1.4 versions.CVE-2022-46816 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Booking Ultra Pro Appointments Booking Calendar Plugin plugin <= 1.1.4 versions.
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 10, 2023Appointment and Event Booking Calendar for WordPress - Amelia versions prior to 1.0.76: Cross-site scriptingCVE-2023-27918 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Appointment and Event Booking Calendar for WordPress - Amelia versions prior to 1.0.76 allows a remote unauthenticated attacker to inject an arbitrary script by having a user who is logging in the WordPress where the product is installed visit a malicious URL.
- Product
- Appointment and Event Booking Calendar for WordPress - Amelia versions prior to 1.0.76
- Fixed in
- 1.0.76
- What to do
- Update Appointment and Event Booking Calendar for WordPress - Amelia versions prior to 1.0.76 to 1.0.76 or newer.
Feb 17, 2023WpDevArt Booking calendar, Appointment Booking System plugin <= 3.2.3 versions affects plugin forms actions: Cross-Site Request Forgery (CSRF)CVE-2023-24388 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WpDevArt Booking calendar, Appointment Booking System plugin <= 3.2.3 versions affects plugin forms actions (create, duplicate, edit, delete).
- Product
- WpDevArt Booking calendar, Appointment Booking System plugin <= 3.2.3 versions affects plugin forms actions
- Fixed in
- 3.2.4
- What to do
- Update WpDevArt Booking calendar, Appointment Booking System plugin <= 3.2.3 versions affects plugin forms actions to 3.2.4 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 12, 2022Booking calendar, Appointment Booking System: Does not validate uploaded filesCVE-2022-3982 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Booking calendar, Appointment Booking System WordPress plugin before 3.2.2 does not validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as PHP and achieve RCE
- Product
- Booking calendar, Appointment Booking System
- Fixed in
- 3.2.2
- What to do
- Update Booking calendar, Appointment Booking System to 3.2.2 or newer.
Dec 5, 2022Cross-Site Request Forgery (CSRF) vulnerability in Advanced Booking Calendar plugin <= 1.7.1 on WordPress.CVE-2022-45824 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Advanced Booking Calendar plugin <= 1.7.1 on WordPress.
- Affected
- up to 1.7.1
- What to do
- Affects up to 1.7.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 18, 2022Missing Authorization vulnerability in Appointment Booking Calendar plugin <= 1.3.69 on WordPress.CVE-2022-43482 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Appointment Booking Calendar plugin <= 1.3.69 on WordPress.
- Affected
- up to 1.3.69
- What to do
- Affects up to 1.3.69. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Sep 6, 2022Cross-Site Request Forgery (CSRF) vulnerability in WPdevelop/Oplugins Booking Calendar plugin <= 9.2.1 at WordPress leading to Translations Update.CVE-2022-33177 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in WPdevelop/Oplugins Booking Calendar plugin <= 9.2.1 at WordPress leading to Translations Update.
- Affected
- up to 9.2.1
- What to do
- Affects up to 9.2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
May 10, 2022Booking Calendar: PHP Object InjectionCVE-2022-1463 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Booking Calendar plugin for WordPress is vulnerable to PHP Object Injection via the [bookingflextimeline] shortcode in versions up to, and including, 9.1. This could be exploited by subscriber-level users and above to call arbitrary PHP objects on a vulnerable site.
- Product
- Booking Calendar
- Affected
- up to 9.1
- What to do
- Affects up to 9.1. Update Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordfence.comwordfence.com
Apr 11, 2022Advanced Booking Calendar: Does not sanitise and escape the room parameter before outputting it back in an admin pageCVE-2022-1007 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advanced Booking Calendar WordPress plugin before 1.7.1 does not sanitise and escape the room parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue
- Product
- Advanced Booking Calendar
- Fixed in
- 1.7.1
- What to do
- Update Advanced Booking Calendar to 1.7.1 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Apr 11, 2022Advanced Booking Calendar: Does not sanitise and escape the id parameterCVE-2022-1006 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Advanced Booking Calendar WordPress plugin before 1.7.1 does not sanitise and escape the id parameter when editing Calendars, which could allow high privilege users such as admin to perform SQL injection attacks
- Product
- Advanced Booking Calendar
- Fixed in
- 1.7.1
- What to do
- Update Advanced Booking Calendar to 1.7.1 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Apr 4, 2022Booking Package: Requires a token for exporting the ical representation of it's booking calendarCVE-2022-0709 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Booking Package WordPress plugin before 1.5.29 requires a token for exporting the ical representation of it's booking calendar, but this token is returned in the json response to unauthenticated users performing a booking, leading to a sensitive data disclosure vulnerability.
- Product
- Booking Package
- Fixed in
- 1.5.29
- What to do
- Update Booking Package to 1.5.29 or newer.
Mar 21, 2022Advanced Booking Calendar: Does not validate and escape the calendar parameter before using it in a SQL statement via the abc_booking_getSingleCalendar AJAX action (available to both unauthenticated and authenticated useCVE-2022-0694 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Advanced Booking Calendar WordPress plugin before 1.7.0 does not validate and escape the calendar parameter before using it in a SQL statement via the abc_booking_getSingleCalendar AJAX action (available to both unauthenticated and authenticated users), leading to an unauthenticated SQL injection
- Product
- Advanced Booking Calendar
- Fixed in
- 1.7.0
- What to do
- Update Advanced Booking Calendar to 1.7.0 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Jan 3, 2022Booking Calendar: Does not sanitise and escape the booking_type parameter before outputting it back in an admin pageCVE-2021-25040 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Booking Calendar WordPress plugin before 8.9.2 does not sanitise and escape the booking_type parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
- Product
- Booking Calendar
- Fixed in
- 8.9.2
- What to do
- Update Booking Calendar to 8.9.2 or newer.
Nov 24, 2021Booking Package - Appointment Booking Calendar System versions prior to 1.5.11: Cross-site scriptingCVE-2021-20840 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Booking Package - Appointment Booking Calendar System versions prior to 1.5.11 allows a remote attacker to inject an arbitrary script via unspecified vectors.
- Product
- Booking Package - Appointment Booking Calendar System versions prior to 1.5.11
- Fixed in
- 1.5.11
- What to do
- Update Booking Package - Appointment Booking Calendar System versions prior to 1.5.11 to 1.5.11 or newer.
Sep 13, 2021WP Simple Booking Calendar: Did not escapeCVE-2021-24726 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Simple Booking Calendar WordPress plugin before 2.0.6 did not escape, validate or sanitise the orderby parameter in its Search Calendars action, before using it in a SQL statement, leading to an authenticated SQL injection issue
- Product
- WP Simple Booking Calendar
- Fixed in
- 2.0.6
- What to do
- Update WP Simple Booking Calendar to 2.0.6 or newer.
Full record and what to do →NVD recordwpscan.comtrustwave.com
Apr 22, 2021Advanced Booking Calendar: Does not sanitise the license error messageCVE-2021-24232 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Advanced Booking Calendar WordPress plugin before 1.6.8 does not sanitise the license error message when output in the settings page, leading to an authenticated reflected Cross-Site Scripting issue
- Product
- Advanced Booking Calendar
- Fixed in
- 1.6.8
- What to do
- Update Advanced Booking Calendar to 1.6.8 or newer.
Apr 12, 2021Advanced Booking Calendar: Did not sanitise the calId GET parameter in the "Seasons & Calendars" page before outputing it in an A tagCVE-2021-24225 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Advanced Booking Calendar WordPress plugin before 1.6.7 did not sanitise the calId GET parameter in the "Seasons & Calendars" page before outputing it in an A tag, leading to a reflected XSS issue
- Product
- Advanced Booking Calendar
- Fixed in
- 1.6.7
- What to do
- Update Advanced Booking Calendar to 1.6.7 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 4, 2020The Appointment Booking Calendar plugin before 1.3.35 for WordPress allows user input (in fields such as Description or Name) in any booking form to be any formCVE-2020-9372 · WordPress plugins & themes · reported by MITREHigh 7.8
The Appointment Booking Calendar plugin before 1.3.35 for WordPress allows user input (in fields such as Description or Name) in any booking form to be any formula, which then could be exported via the Bookings list tab in /wp-admin/admin.php?page=cpabc_appointments.php. The attacker could achieve remote code execution via CSV injection.
- Product
- Appointment Booking Calendar
- Fixed in
- 1.3.35
- What to do
- Update Appointment Booking Calendar to 1.3.35 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comdrive.google.com
Mar 4, 2020Stored XSS exists in the Appointment Booking Calendar plugin before 1.3.35 for WordPress.CVE-2020-9371 · WordPress plugins & themes · reported by MITREMedium 4.8
Stored XSS exists in the Appointment Booking Calendar plugin before 1.3.35 for WordPress. In the cpabc_appointments.php file, the Calendar Name input could allow attackers to inject arbitrary JavaScript or HTML.
- Product
- Stored XSS exists in the Appointment Booking Calendar
- Fixed in
- 1.3.35
- What to do
- Update Stored XSS exists in the Appointment Booking Calendar to 1.3.35 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comdrive.google.com
Aug 9, 2019The Appointment Booking Calendar plugin 1.3.18 for WordPress allows XSS via the wp-admin/admin-post.php editionarea parameter.CVE-2019-14791 · WordPress plugins & themes · reported by MITREMedium 6.1
The Appointment Booking Calendar plugin 1.3.18 for WordPress allows XSS via the wp-admin/admin-post.php editionarea parameter.
- Affected
- 1.3.18 to 1.3.18
- What to do
- Affects 1.3.18 to 1.3.18. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Mar 21, 2019Booking Calendar plugin 8.4.3 for: SQL injectionCVE-2018-20556 · WordPress plugins & themes · reported by MITREHigh 8.8
SQL injection vulnerability in Booking Calendar plugin 8.4.3 for WordPress allows remote attackers to execute arbitrary SQL commands via the booking_id parameter.
- Product
- Booking Calendar plugin 8.4.3 for
- Affected
- 8.4.3 to 8.4.3
- What to do
- Affects 8.4.3 to 8.4.3. Update Booking Calendar plugin 8.4.3 for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comgist.github.com
Jun 13, 2018An issue was discovered in the WpDevArt "Booking calendar, Appointment Booking System" plugin 2.2.2 for WordPress.CVE-2018-10363 · WordPress plugins & themes · reported by MITREHigh 7.5
An issue was discovered in the WpDevArt "Booking calendar, Appointment Booking System" plugin 2.2.2 for WordPress. Multiple parameters allow remote attackers to manipulate the values to change data such as prices.
- Product
- WpDevArt "Booking calendar, Appointment Booking System
- Affected
- 2.2.2 to 2.2.2
- What to do
- Affects 2.2.2 to 2.2.2. Update WpDevArt "Booking calendar, Appointment Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgist.github.comgist.github.com
Apr 28, 2017Cross-site scripting vulnerability in Booking Calendar version 7.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified veCVE-2017-2151 · Other software · wpdevelop · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Booking Calendar version 7.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Booking Calendar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpwpbookingcalendar.com
Apr 28, 2017Directory traversal vulnerability in Booking Calendar version 7.0 and earlier allows remote attackers to read arbitrary files via specially crafted captcha_chalCVE-2017-2150 · Other software · wpdevelop · reported by vultures@jpcert.or.jpMedium 5.3
Directory traversal vulnerability in Booking Calendar version 7.0 and earlier allows remote attackers to read arbitrary files via specially crafted captcha_chalange parameter.
- Product
- Booking Calendar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpwpbookingcalendar.com
Sep 29, 2015Multiple cross-site scripting (XSS) vulnerabilities in cpabc_appointments_admin_int_bookings_list.inc.php in the Appointment Booking Calendar plugin before 1.1.CVE-2015-7320 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in cpabc_appointments_admin_int_bookings_list.inc.php in the Appointment Booking Calendar plugin before 1.1.8 for WordPress allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Fixed in
- 1.1.8
- What to do
- Update the plugin to 1.1.8 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comsecurityfocus.com
Sep 29, 2015SQL injection vulnerability in cpabc_appointments_admin_int_calendar_list.inc.php in the Appointment Booking Calendar plugin before 1.1.8 for WordPress allows rCVE-2015-7319 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in cpabc_appointments_admin_int_calendar_list.inc.php in the Appointment Booking Calendar plugin before 1.1.8 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors related to updating the username.
- Product
- SQL injection vulnerability in cpabc_appointments_admin_int_calendar_list.inc.php in the Appointment Booking Calendar
- Fixed in
- 1.1.8
- What to do
- Update SQL injection vulnerability in cpabc_appointments_admin_int_calendar_list.inc.php in the Appointment Booking Calendar to 1.1.8 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comsecurityfocus.com
Jan 13, 2015SQL injection vulnerability in load-calendar.php in PHPJabbers Event Booking Calendar 2.0 allows remote attackers to execute arbitrary SQL commands via the cid CVE-2014-10015 · Websites & servers · Phpjabbers · reported by MITREHigh 7.5
SQL injection vulnerability in load-calendar.php in PHPJabbers Event Booking Calendar 2.0 allows remote attackers to execute arbitrary SQL commands via the cid parameter.
- Product
- Event Booking Calendar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Jan 13, 2015Multiple cross-site request forgery (CSRF) vulnerabilities in PHPJabbers Event Booking Calendar 2.0 allow remote attackers to hijack the authentication of adminCVE-2014-10014 · Websites & servers · Phpjabbers · reported by MITREMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in PHPJabbers Event Booking Calendar 2.0 allow remote attackers to hijack the authentication of administrators for requests that (1) change the username and password of the administrator via an update action to the AdminOptions controller or conduct cross-site scripting (XSS) attacks via the (2) event_title parameter in a create action to the AdminEvents controller or (3) category_title parameter in a create action to the AdminCategories controller.
- Product
- Event Booking Calendar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comsecunia.com
May 22, 2014SQL injection vulnerability in dopbs-backend-forms.php in the Booking System (Booking Calendar) plugin before 1.3 for WordPress allows remote authenticated userCVE-2014-3210 · WordPress plugins & themes · reported by MITREMedium 6.5
SQL injection vulnerability in dopbs-backend-forms.php in the Booking System (Booking Calendar) plugin before 1.3 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the booking_form_id parameter to wp-admin/admin-ajax.php.
- Product
- SQL injection vulnerability in dopbs-backend-forms.php in the Booking System (Booking Calendar)
- Fixed in
- 1.3
- What to do
- Update SQL injection vulnerability in dopbs-backend-forms.php in the Booking System (Booking Calendar) to 1.3 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwordpress.org
Dec 30, 2011Cross-site scripting (XSS) vulnerability in details_view.php in PHP Booking Calendar 10e allows remote attackers to inject arbitrary web script or HTML via the CVE-2011-5045 · Other software · Jjwdesign · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in details_view.php in PHP Booking Calendar 10e allows remote attackers to inject arbitrary web script or HTML via the page_info_message parameter.
- Product
- PHP Booking Calendar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comsourceforge.net
Mar 28, 2006SQL injection vulnerability in details_view.php in PHP Booking Calendar 1.0c and earlier allows remote attackers to execute arbitrary SQL commands via the eventCVE-2006-1422 · Other software · Jjwwebdesign · reported by MITREMedium 5
SQL injection vulnerability in details_view.php in PHP Booking Calendar 1.0c and earlier allows remote attackers to execute arbitrary SQL commands via the event_id parameter.
- Product
- Phpbookingcalendar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comexchange.xforce.ibmcloud.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.