CVE-2022-0694: falha em Advanced Booking Calendar
Advanced Booking Calendar < 1.7.0 - Unauthenticated SQL Injection
Publicada em · Atualizada em
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 1.8%
probabilidade de exploração
1.8%top 22% das CVEs
exploração observada
nãonenhuma fonte reporta
The Advanced Booking Calendar WordPress plugin before 1.7.0 does not validate and escape the calendar parameter before using it in a SQL statement via the abc_booking_getSingleCalendar AJAX action (available to both unauthenticated and authenticated users), leading to an unauthenticated SQL injection
Produtos afetados
Unknown · Advanced Booking CalendarCVEs relacionadas — Advanced Booking Calendar
No mesmo produto, das mais perigosas para as menos.
CVE-2022-1007—Advanced Booking Calendar < 1.7.1 - Reflected Cross-Site ScriptingEPSS 1.9%CVE-2022-1006—Advanced Booking Calendar < 1.7.1 - Admin+ SQLiEPSS 1.5%CVE-2021-24225—Advanced Booking Calendar < 1.6.7 - Authenticated Reflected Cross-Site Scripting (XSS)EPSS 0.7%CVE-2021-24232—Advanced Booking Calendar < 1.6.8 - Authenticated Reflected Cross-Site Scripting (XSS)EPSS 0.6%