Advisories · Technology
jetmonsters MotoPress Appointment Booking.
Every CVE that names jetmonsters MotoPress Appointment Booking among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.4 Medium
MotoPress Appointment Booking <= 2.4.8 - Unauthenticated Stored Cross-Site Scripting via Customer Name via /customers/create REST Endpoint
- jetmonsters MotoPress Appointment Booking
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
MotoPress Appointment Booking <= 2.4.4 - Unauthenticated Insecure Direct Object Reference to 'payment_details.booking_id' Parameter
- jetmonsters MotoPress Appointment Booking
- Broken access control
- CVSS 6.5 Medium
MotoPress Appointment Booking <= 2.4.5 - Authenticated (Staff+) SQL Injection via 's' Parameter
- jetmonsters MotoPress Appointment Booking
- SQL injection