Vulnerabilidades em LatePoint
49 resultadosAnálise Vexday
LatePoint apresenta um perfil de risco moderado com 4 vulnerabilidades catalogadas, incluindo 1 crítica (CVSS), mas sem registros de exploração ativa em ambiente real. A ameaça é crescente: 2 das 4 falhas foram publicadas nos últimos 90 dias, predominantemente relacionadas a problemas de privilégios (CWE-266), indicando necessidade de monitoramento contínuo e priorização de patches recentes.
CVE-2024-8943CRITICALLatePoint <= 5.0.12 - Authentication BypassEPSS 3.1%CVE-2024-8911CRITICALLatePoint <= 5.0.11 - Unauthenticated Arbitrary User Password Change via SQL InjectionEPSS 2.9%CVE-2026-118066CRITICALAppointment Booking Plugin <= 5.7.6 - Unauthenticated Authentication Bypass via Account Takeover via 'IS NOT NULL' Sentinel in 'password_reset_token' ParameterEPSS 0.9%CVE-2026-7652MEDIUMLatePoint <= 5.5.0 - Unauthenticated Account Takeover via Weak Password Recovery MechanismEPSS 0.7%CVE-2026-92966CRITICALAppointment Booking Plugin <= 5.7.0 - Unauthenticated Arbitrary Shortcode Execution via First/Last Name FieldEPSS 0.7%CVE-2026-5234MEDIUMLatePoint <= 5.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Financial Data Exposure via Sequential Invoice IDEPSS 0.7%CVE-2026-12657MEDIUMLatePoint <= 5.6.2 - Unauthenticated Insecure Direct Object Reference to Arbitrary Creation via 'service_id' ParameterEPSS 0.7%CVE-2024-2472CRITICALLatePoint Plugin <= 4.9.9 - Missing Authorization and Sensitive Information Exposure via IDOREPSS 0.6%CVE-2026-13228HIGHLatePoint <= 5.6.3 - Authenticated (Custom+) Privilege Escalation to Administrator via 'order[customer_id]' ParameterEPSS 0.6%CVE-2026-11398MEDIUMLatePoint <= 5.6.1 - Missing Authorization to Unauthenticated Arbitrary Customer Data Modification via process_step_customer() Booking Form Customer StepEPSS 0.6%CVE-2026-103366HIGHAppointment Booking Plugin <= 5.7.3 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'booking[id]' and 'cart[id]' ParametersEPSS 0.5%CVE-2026-8176HIGHLatePoint <= 5.5.1 - Authenticated (Agent+) Privilege Escalation to Administrator via IDOR in OsOrdersController::create_or_update + Unauthenticated Customer-Cabinet Password ResetEPSS 0.5%CVE-2026-13471MEDIUMLatePoint <= 5.6.3 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Booking Deletion and Customer/Booking Data Disclosure via Abilities REST API (list-bookings, list-customers, delete-booking)EPSS 0.5%CVE-2026-7332HIGHLatePoint <= 5.5.0 - Unauthenticated Stored Cross-Site Scripting via 'booking_form_page_url' ParameterEPSS 0.4%CVE-2026-100163HIGHAppointment Booking Plugin <= 5.7.2 - Unauthenticated Authentication Bypass to Customer Account Takeover via Insufficient Verification in create_wp_user_for_customer() username_exists FallbackEPSS 0.4%CVE-2026-18441MEDIUMLatePoint - Appointment Booking & Scheduling <= 5.6.9 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure via 'customer[id]' ParameterEPSS 0.4%CVE-2025-7038HIGHLatePoint <= 5.1.94 - Unauthenticated Authentication Bypass via load_step FunctionEPSS 0.4%CVE-2026-0617HIGHLatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.5 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.4%CVE-2026-110653CRITICALAppointment Booking Plugin <= 5.7.4 - Unauthenticated Authentication Bypass via Race Condition on OTP Attempts CounterEPSS 0.4%CVE-2026-57714CRITICALWordPress LatePoint plugin <= 5.6.3 - SQL Injection vulnerabilityEPSS 0.4%