CVE-2024-2441: fallo de gravedad alta en VikBooking Hotel Booking Engine & PMS
VikBooking < 1.6.8 - Insecure Direct Object References
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.1epss 0.6%
The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8 allows direct access to menus, allowing an authenticated user with subscriber privileges or above, to bypass authorization and access settings of the VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8's they shouldn't be allowed to.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Productos afectados
Unknown · VikBooking Hotel Booking Engine & PMSCVEs relacionadas — VikBooking Hotel Booking Engine & PMS
En el mismo producto, de las más peligrosas a las menos.
CVE-2022-1409—VikBooking Hotel Booking Engine & PMS < 1.5.8 - Admin+ PHP File UploadEPSS 1.5%CVE-2022-1528—VikBooking < 1.5.9 - Reflected Cross-Site ScriptingEPSS 0.8%CVE-2022-1408—VikBooking Hotel Booking Engine & PMS < 1.5.8 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2022-1407—VikBooking Hotel Booking Engine & PMS < 1.5.7 - Stored Cross-Site Scripting via CSRFEPSS 0.5%CVE-2026-85127HIGHVikBooking 1.8.8 - 1.8.14 - Unauthenticated Stored XSS via SVG Chat AttachmentEPSS 0.4%CVE-2024-13616MEDIUMVikBooking < 1.7.2 - Admin+ Stored XSSEPSS 0.3%