CVE-2024-2441: falha de alta gravidade em VikBooking Hotel Booking Engine & PMS
VikBooking < 1.6.8 - Insecure Direct Object References
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.1epss 0.6%
The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8 allows direct access to menus, allowing an authenticated user with subscriber privileges or above, to bypass authorization and access settings of the VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8's they shouldn't be allowed to.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Produtos afetados
Unknown · VikBooking Hotel Booking Engine & PMSCVEs relacionadas — VikBooking Hotel Booking Engine & PMS
No mesmo produto, das mais perigosas para as menos.
CVE-2022-1409—VikBooking Hotel Booking Engine & PMS < 1.5.8 - Admin+ PHP File UploadEPSS 1.5%CVE-2022-1528—VikBooking < 1.5.9 - Reflected Cross-Site ScriptingEPSS 0.8%CVE-2022-1408—VikBooking Hotel Booking Engine & PMS < 1.5.8 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2022-1407—VikBooking Hotel Booking Engine & PMS < 1.5.7 - Stored Cross-Site Scripting via CSRFEPSS 0.5%CVE-2026-85127HIGHVikBooking 1.8.8 - 1.8.14 - Unauthenticated Stored XSS via SVG Chat AttachmentEPSS 0.4%CVE-2024-13616MEDIUMVikBooking < 1.7.2 - Admin+ Stored XSSEPSS 0.3%