Advisories · Technology
melograno Booking for Appointments and Events Calendar – Amelia.
Every CVE that names melograno Booking for Appointments and Events Calendar – Amelia among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.3 Medium
Booking for Appointments and Events Calendar <= 2.4.12 - Unauthenticated Sensitive Information Exposure in 'page' Parameter
- melograno Booking for Appointments and Events Calendar – Amelia
- Information disclosure
- CVSS 5.4 Medium
Booking for Appointments and Events Calendar – Amelia (Premium) <= 2.4.4 - Authenticated (Custom+) Missing Authorization to Limited Account Takeover
- melograno Booking for Appointments and Events Calendar – Amelia
- Broken access control
- CVSS 5.3 Medium
Booking for Appointments and Events Calendar - Amelia <= 2.4.5 - Missing Authorization to Unauthenticated Payment Bypass
- melograno Booking for Appointments and Events Calendar – Amelia
- Broken access control
- CVSS 6.4 Medium
Booking for Appointments and Events Calendar – Amelia <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'load_manually' Parameter
- melograno Booking for Appointments and Events Calendar – Amelia
- Cross-site scripting (XSS)
- CVSS 9.8 CriticalCritical · CVSS 9+
Booking for Appointments and Events Calendar – Amelia (Premium) 8.0 - 9.6.2 - Unauthenticated Privilege Escalation to Administrator via 'externalId'
- melograno Booking for Appointments and Events Calendar – Amelia
- Privilege escalation
- CVSS 7.2 High
Booking for Appointments and Events Calendar <= 2.2 - Unauthenticated Stored Cross-Site Scripting via Customer Name Fields in Booking Submission
- melograno Booking for Appointments and Events Calendar – Amelia
- Cross-site scripting (XSS)
- CVSS 4.9 Medium
Booking for Appointments and Events Calendar – Amelia <= 2.4.3 - Authenticated (Custom+) SQL Injection via Customer Import
- melograno Booking for Appointments and Events Calendar – Amelia
- SQL injection