Amelia Events Appointments Booking Calendar (Unknown) - vulnerabilities (CVEs)

5 CVEs, 0 in the last 30 days, 1 known versions, newest CVE from 2022-04-04. Vendor: Unknown.

CVEs of Amelia Events Appointments Booking Calendar

• CVE-2022-0825 - CVSS 5.4 (medium), 2022-04-04: The Amelia WordPress plugin before 1.0.49 does not have proper authorisation when managing appointments, allowing any customer to update other's booking…
• CVE-2022-0720 - CVSS 5.4 (medium), 2022-03-28: The Amelia WordPress plugin before 1.0.47 does not have proper authorisation when managing appointments, allowing any customer to update other's booking, as…
• CVE-2022-0687 - CVSS 8.8 (high), 2022-03-21: The Amelia WordPress plugin before 1.0.47 stores image blobs into actual files whose extension is controlled by the user, which may lead to PHP backdoors…
• CVE-2022-0627 - CVSS 6.1 (medium), 2022-03-21: The Amelia WordPress plugin before 1.0.47 does not sanitize and escape the code parameter before outputting it back in an admin page, leading to a Reflected…
• CVE-2022-0616 - CVSS 4.3 (medium), 2022-03-21: The Amelia WordPress plugin before 1.0.47 does not have CSRF check in place when deleting customers, which could allow attackers to make a logged in admin…