CVE-2022-0421: falha de média gravidade em Five Star Restaurant Reservations
Five Star Restaurant Reservations < 2.4.12 - Unauthenticated Arbitrary Payment Status Update to Stored XSS
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.1epss 0.6%
The Five Star Restaurant Reservations WordPress plugin before 2.4.12 does not have authorisation when changing whether a payment was successful or failed, allowing unauthenticated users to change the payment status of arbitrary bookings. Furthermore, due to the lack of sanitisation and escaping, attackers could perform Cross-Site Scripting attacks against a logged in admin viewing the failed payments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Produtos afetados
Unknown · Five Star Restaurant ReservationsCVEs relacionadas — Five Star Restaurant Reservations
No mesmo produto, das mais perigosas para as menos.
CVE-2026-15151HIGHFive Star Restaurant Reservations < 2.7.23 - Booking Manager+ Missing Authorization via rtb_reset_notificationsEPSS 0.4%CVE-2026-15147MEDIUMFive Star Restaurant Reservations < 2.7.23 - Unauthenticated Payment Bypass and Booking Confirmation via IDOREPSS 0.2%CVE-2026-0658MEDIUMFive Star Restaurant Reservations < 2.7.9 - Arbitrary Bookings Deletion via CSRFEPSS 0.2%