Advisories · Technology
masaakitanaka Booking Package.
Every CVE that names masaakitanaka Booking Package among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.4 Medium
Booking Package <= 1.7.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute
- masaakitanaka Booking Package
- Cross-site scripting (XSS)
- CVSS 7.5 High
Booking Package <= 1.7.29 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'mode=sendBooking' with nonexistent 'timeKey' and 'public=0'
- masaakitanaka Booking Package
- Broken access control
- CVSS 7.5 High
Booking Package <= 1.7.20 - Unauthenticated SQL Injection via 'email' Form Parameter
- masaakitanaka Booking Package
- SQL injection
- CVSS 7.2 High
Booking Package <= 1.7.16 - Authenticated (Editor+) Privilege Escalation via Account Takeover to updateUser AJAX Action
- masaakitanaka Booking Package
- Broken access control
- CVSS 5.3 Medium
Booking Package <= 1.7.06 - Unauthenticated Price Manipulation via 'amount' Parameter
- masaakitanaka Booking Package
- CWE-472
- CVSS 6.1 Medium
Booking Package <= 1.6.72 - Reflected Cross-Site Scripting via Locale Parameter
- masaakitanaka Booking Package
- Cross-site scripting (XSS)