Advisories · Technology
themetechmount TrueBooker – Appointment Booking and Scheduler System.
Every CVE that names themetechmount TrueBooker – Appointment Booking and Scheduler System among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 9.8 CriticalCritical · CVSS 9+
TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary User Email Modification via 'admin_addcustomer' AJAX Action
- themetechmount TrueBooker – Appointment Booking and Scheduler System
- Broken access control
- CVSS 9.8 CriticalCritical · CVSS 9+
TrueBooker <= 1.2.6 - Unauthenticated Authorization Bypass Through User-Controlled Key to Account Takeover to 'truebooker_wp_user_id' Parameter
- themetechmount TrueBooker – Appointment Booking and Scheduler System
- Broken access control
- CVSS 9.8 CriticalCritical · CVSS 9+
TrueBooker <= 1.2.6 - Unauthenticated Account Takeover via Insecure Direct Object Reference in 'truebooker_wp_user_id' Parameter
- themetechmount TrueBooker – Appointment Booking and Scheduler System
- Broken access control
- CVSS 9.8 CriticalCritical · CVSS 9+
TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary Password Reset via 'tbab-userid'
- themetechmount TrueBooker – Appointment Booking and Scheduler System
- CWE-640
- CVSS 9.8 CriticalCritical · CVSS 9+
TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary Password Reset via 'truebooker_wp_user_id'
- themetechmount TrueBooker – Appointment Booking and Scheduler System
- Broken access control
- CVSS 7.5 High
TrueBooker <= 1.2.2 - Unauthenticated SQL Injection
- themetechmount TrueBooker – Appointment Booking and Scheduler System
- SQL injection
- CVSS 5.3 Medium
Truebooker - Appointment Booking and Scheduler Plugin <= 1.1.4 - Sensitive Information Exposure via Views Files
- themetechmount TrueBooker – Appointment Booking and Scheduler System
- Broken access control