All the vulnerabilites related to Unknown - Amelia – Events & Appointments Booking Calendar
cve-2022-0687
Vulnerability from cvelistv5
Published
2022-03-21 18:55
Modified
2024-08-02 23:40
Severity ?
EPSS score ?
Summary
Amelia < 1.0.46 - Manager+ RCE
References
| ▼ | URL | Tags |
|---|---|---|
| https://wpscan.com/vulnerability/3cf05815-9b74-4491-a935-d69a0834146c | x_refsource_MISC |
Impacted products
| ▼ | Vendor | Product |
|---|---|---|
| Unknown | Amelia – Events & Appointments Booking Calendar |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T23:40:03.132Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://wpscan.com/vulnerability/3cf05815-9b74-4491-a935-d69a0834146c"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Amelia \u2013 Events \u0026 Appointments Booking Calendar",
"vendor": "Unknown",
"versions": [
{
"lessThan": "1.0.47",
"status": "affected",
"version": "1.0.47",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "qerogram"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Amelia WordPress plugin before 1.0.47 stores image blobs into actual files whose extension is controlled by the user, which may lead to PHP backdoors being uploaded onto the site. This vulnerability can be exploited by logged-in users with the custom \"Amelia Manager\" role."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-03-21T18:55:57",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://wpscan.com/vulnerability/3cf05815-9b74-4491-a935-d69a0834146c"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Amelia \u003c 1.0.46 - Manager+ RCE",
"x_generator": "WPScan CVE Generator",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "contact@wpscan.com",
"ID": "CVE-2022-0687",
"STATE": "PUBLIC",
"TITLE": "Amelia \u003c 1.0.46 - Manager+ RCE"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Amelia \u2013 Events \u0026 Appointments Booking Calendar",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "1.0.47",
"version_value": "1.0.47"
}
]
}
}
]
},
"vendor_name": "Unknown"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "qerogram"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Amelia WordPress plugin before 1.0.47 stores image blobs into actual files whose extension is controlled by the user, which may lead to PHP backdoors being uploaded onto the site. This vulnerability can be exploited by logged-in users with the custom \"Amelia Manager\" role."
}
]
},
"generator": "WPScan CVE Generator",
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-434 Unrestricted Upload of File with Dangerous Type"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://wpscan.com/vulnerability/3cf05815-9b74-4491-a935-d69a0834146c",
"refsource": "MISC",
"url": "https://wpscan.com/vulnerability/3cf05815-9b74-4491-a935-d69a0834146c"
}
]
},
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2022-0687",
"datePublished": "2022-03-21T18:55:57",
"dateReserved": "2022-02-19T00:00:00",
"dateUpdated": "2024-08-02T23:40:03.132Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-0616
Vulnerability from cvelistv5
Published
2022-03-21 18:55
Modified
2024-08-02 23:32
Severity ?
EPSS score ?
Summary
Amelia < 1.0.46 - Arbitrary Customer Deletion via CSRF
References
| ▼ | URL | Tags |
|---|---|---|
| https://wpscan.com/vulnerability/7c63d76e-34ca-4778-8784-437d446c16e0 | x_refsource_MISC |
Impacted products
| ▼ | Vendor | Product |
|---|---|---|
| Unknown | Amelia – Events & Appointments Booking Calendar |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T23:32:46.481Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://wpscan.com/vulnerability/7c63d76e-34ca-4778-8784-437d446c16e0"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Amelia \u2013 Events \u0026 Appointments Booking Calendar",
"vendor": "Unknown",
"versions": [
{
"lessThan": "1.0.47",
"status": "affected",
"version": "1.0.47",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Muhamad Hidayat"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Amelia WordPress plugin before 1.0.47 does not have CSRF check in place when deleting customers, which could allow attackers to make a logged in admin delete arbitrary customers via a CSRF attack"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352 Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-03-21T18:55:50",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://wpscan.com/vulnerability/7c63d76e-34ca-4778-8784-437d446c16e0"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Amelia \u003c 1.0.46 - Arbitrary Customer Deletion via CSRF",
"x_generator": "WPScan CVE Generator",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "contact@wpscan.com",
"ID": "CVE-2022-0616",
"STATE": "PUBLIC",
"TITLE": "Amelia \u003c 1.0.46 - Arbitrary Customer Deletion via CSRF"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Amelia \u2013 Events \u0026 Appointments Booking Calendar",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "1.0.47",
"version_value": "1.0.47"
}
]
}
}
]
},
"vendor_name": "Unknown"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Muhamad Hidayat"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Amelia WordPress plugin before 1.0.47 does not have CSRF check in place when deleting customers, which could allow attackers to make a logged in admin delete arbitrary customers via a CSRF attack"
}
]
},
"generator": "WPScan CVE Generator",
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-352 Cross-Site Request Forgery (CSRF)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://wpscan.com/vulnerability/7c63d76e-34ca-4778-8784-437d446c16e0",
"refsource": "MISC",
"url": "https://wpscan.com/vulnerability/7c63d76e-34ca-4778-8784-437d446c16e0"
}
]
},
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2022-0616",
"datePublished": "2022-03-21T18:55:50",
"dateReserved": "2022-02-15T00:00:00",
"dateUpdated": "2024-08-02T23:32:46.481Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-0720
Vulnerability from cvelistv5
Published
2022-03-28 17:23
Modified
2024-08-02 23:40
Severity ?
EPSS score ?
Summary
Amelia < 1.0.47 - Customer+ Arbitrary Appointments Update and Sensitive Data Disclosure
References
| ▼ | URL | Tags |
|---|---|---|
| https://wpscan.com/vulnerability/435ef99c-9210-46c7-80a4-09cd4d3d00cf | x_refsource_MISC |
Impacted products
| ▼ | Vendor | Product |
|---|---|---|
| Unknown | Amelia – Events & Appointments Booking Calendar |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T23:40:03.374Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://wpscan.com/vulnerability/435ef99c-9210-46c7-80a4-09cd4d3d00cf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Amelia \u2013 Events \u0026 Appointments Booking Calendar",
"vendor": "Unknown",
"versions": [
{
"lessThan": "1.0.47",
"status": "affected",
"version": "1.0.47",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "huli of Cymetrics"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Amelia WordPress plugin before 1.0.47 does not have proper authorisation when managing appointments, allowing any customer to update other\u0027s booking, as well as retrieve sensitive information about the bookings, such as the full name and phone number of the person who booked it."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-03-28T17:23:18",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://wpscan.com/vulnerability/435ef99c-9210-46c7-80a4-09cd4d3d00cf"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Amelia \u003c 1.0.47 - Customer+ Arbitrary Appointments Update and Sensitive Data Disclosure",
"x_generator": "WPScan CVE Generator",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "contact@wpscan.com",
"ID": "CVE-2022-0720",
"STATE": "PUBLIC",
"TITLE": "Amelia \u003c 1.0.47 - Customer+ Arbitrary Appointments Update and Sensitive Data Disclosure"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Amelia \u2013 Events \u0026 Appointments Booking Calendar",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "1.0.47",
"version_value": "1.0.47"
}
]
}
}
]
},
"vendor_name": "Unknown"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "huli of Cymetrics"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Amelia WordPress plugin before 1.0.47 does not have proper authorisation when managing appointments, allowing any customer to update other\u0027s booking, as well as retrieve sensitive information about the bookings, such as the full name and phone number of the person who booked it."
}
]
},
"generator": "WPScan CVE Generator",
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-863 Incorrect Authorization"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://wpscan.com/vulnerability/435ef99c-9210-46c7-80a4-09cd4d3d00cf",
"refsource": "MISC",
"url": "https://wpscan.com/vulnerability/435ef99c-9210-46c7-80a4-09cd4d3d00cf"
}
]
},
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2022-0720",
"datePublished": "2022-03-28T17:23:18",
"dateReserved": "2022-02-22T00:00:00",
"dateUpdated": "2024-08-02T23:40:03.374Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-0825
Vulnerability from cvelistv5
Published
2022-04-04 15:35
Modified
2024-08-02 23:40
Severity ?
EPSS score ?
Summary
Amelia < 1.0.49 - Customer+ Arbitrary Appointments Status Update
References
| ▼ | URL | Tags |
|---|---|---|
| https://wpscan.com/vulnerability/1a92a65f-e9df-41b5-9a1c-8e24ee9bf50e | x_refsource_MISC | |
| https://plugins.trac.wordpress.org/changeset/2693545 | x_refsource_CONFIRM |
Impacted products
| ▼ | Vendor | Product |
|---|---|---|
| Unknown | Amelia – Events & Appointments Booking Calendar |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T23:40:04.464Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://wpscan.com/vulnerability/1a92a65f-e9df-41b5-9a1c-8e24ee9bf50e"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://plugins.trac.wordpress.org/changeset/2693545"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Amelia \u2013 Events \u0026 Appointments Booking Calendar",
"vendor": "Unknown",
"versions": [
{
"lessThan": "1.0.49",
"status": "affected",
"version": "1.0.49",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Huli from Cymetrics"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Amelia WordPress plugin before 1.0.49 does not have proper authorisation when managing appointments, allowing any customer to update other\u0027s booking status, as well as retrieve sensitive information about the bookings, such as the full name and phone number of the person who booked it."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-04-04T15:35:49",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://wpscan.com/vulnerability/1a92a65f-e9df-41b5-9a1c-8e24ee9bf50e"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://plugins.trac.wordpress.org/changeset/2693545"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Amelia \u003c 1.0.49 - Customer+ Arbitrary Appointments Status Update",
"x_generator": "WPScan CVE Generator",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "contact@wpscan.com",
"ID": "CVE-2022-0825",
"STATE": "PUBLIC",
"TITLE": "Amelia \u003c 1.0.49 - Customer+ Arbitrary Appointments Status Update"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Amelia \u2013 Events \u0026 Appointments Booking Calendar",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "1.0.49",
"version_value": "1.0.49"
}
]
}
}
]
},
"vendor_name": "Unknown"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Huli from Cymetrics"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Amelia WordPress plugin before 1.0.49 does not have proper authorisation when managing appointments, allowing any customer to update other\u0027s booking status, as well as retrieve sensitive information about the bookings, such as the full name and phone number of the person who booked it."
}
]
},
"generator": "WPScan CVE Generator",
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-863 Incorrect Authorization"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://wpscan.com/vulnerability/1a92a65f-e9df-41b5-9a1c-8e24ee9bf50e",
"refsource": "MISC",
"url": "https://wpscan.com/vulnerability/1a92a65f-e9df-41b5-9a1c-8e24ee9bf50e"
},
{
"name": "https://plugins.trac.wordpress.org/changeset/2693545",
"refsource": "CONFIRM",
"url": "https://plugins.trac.wordpress.org/changeset/2693545"
}
]
},
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2022-0825",
"datePublished": "2022-04-04T15:35:49",
"dateReserved": "2022-03-02T00:00:00",
"dateUpdated": "2024-08-02T23:40:04.464Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-0627
Vulnerability from cvelistv5
Published
2022-03-21 18:55
Modified
2024-08-02 23:32
Severity ?
EPSS score ?
Summary
Amelia < 1.0.46 - Reflected Cross-Site Scripting
References
| ▼ | URL | Tags |
|---|---|---|
| https://wpscan.com/vulnerability/fd8c720a-a94a-438f-b686-3a734e3c24e4 | x_refsource_MISC |
Impacted products
| ▼ | Vendor | Product |
|---|---|---|
| Unknown | Amelia – Events & Appointments Booking Calendar |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T23:32:46.462Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://wpscan.com/vulnerability/fd8c720a-a94a-438f-b686-3a734e3c24e4"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Amelia \u2013 Events \u0026 Appointments Booking Calendar",
"vendor": "Unknown",
"versions": [
{
"lessThan": "1.0.47",
"status": "affected",
"version": "1.0.47",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Ran Crane"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Amelia WordPress plugin before 1.0.47 does not sanitize and escape the code parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Cross-site Scripting (XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-03-21T18:55:51",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://wpscan.com/vulnerability/fd8c720a-a94a-438f-b686-3a734e3c24e4"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Amelia \u003c 1.0.46 - Reflected Cross-Site Scripting",
"x_generator": "WPScan CVE Generator",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "contact@wpscan.com",
"ID": "CVE-2022-0627",
"STATE": "PUBLIC",
"TITLE": "Amelia \u003c 1.0.46 - Reflected Cross-Site Scripting"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Amelia \u2013 Events \u0026 Appointments Booking Calendar",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "1.0.47",
"version_value": "1.0.47"
}
]
}
}
]
},
"vendor_name": "Unknown"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Ran Crane"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Amelia WordPress plugin before 1.0.47 does not sanitize and escape the code parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting."
}
]
},
"generator": "WPScan CVE Generator",
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-79 Cross-site Scripting (XSS)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://wpscan.com/vulnerability/fd8c720a-a94a-438f-b686-3a734e3c24e4",
"refsource": "MISC",
"url": "https://wpscan.com/vulnerability/fd8c720a-a94a-438f-b686-3a734e3c24e4"
}
]
},
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2022-0627",
"datePublished": "2022-03-21T18:55:51",
"dateReserved": "2022-02-16T00:00:00",
"dateUpdated": "2024-08-02T23:32:46.462Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}