Search
Find a vulnerability
Search criteria
10 vulnerabilities found for Amelia – Events & Appointments Booking Calendar by Unknown
CVE-2022-0825 (GCVE-0-2022-0825)
Vulnerability from nvd – Published: 2022-04-04 15:35 – Updated: 2024-08-02 23:40
VLAI
Title
Amelia < 1.0.49 - Customer+ Arbitrary Appointments Status Update
Summary
The Amelia WordPress plugin before 1.0.49 does not have proper authorisation when managing appointments, allowing any customer to update other's booking status, as well as retrieve sensitive information about the bookings, such as the full name and phone number of the person who booked it.
Severity
No CVSS data available.
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://wpscan.com/vulnerability/1a92a65f-e9df-41… | x_refsource_MISC |
| https://plugins.trac.wordpress.org/changeset/2693545 | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Unknown | Amelia – Events & Appointments Booking Calendar |
Affected:
1.0.49 , < 1.0.49
(custom)
|
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T23:40:04.464Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://wpscan.com/vulnerability/1a92a65f-e9df-41b5-9a1c-8e24ee9bf50e"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://plugins.trac.wordpress.org/changeset/2693545"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Amelia \u2013 Events \u0026 Appointments Booking Calendar",
"vendor": "Unknown",
"versions": [
{
"lessThan": "1.0.49",
"status": "affected",
"version": "1.0.49",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Huli from Cymetrics"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Amelia WordPress plugin before 1.0.49 does not have proper authorisation when managing appointments, allowing any customer to update other\u0027s booking status, as well as retrieve sensitive information about the bookings, such as the full name and phone number of the person who booked it."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-04-04T15:35:49.000Z",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://wpscan.com/vulnerability/1a92a65f-e9df-41b5-9a1c-8e24ee9bf50e"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://plugins.trac.wordpress.org/changeset/2693545"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Amelia \u003c 1.0.49 - Customer+ Arbitrary Appointments Status Update",
"x_generator": "WPScan CVE Generator",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "contact@wpscan.com",
"ID": "CVE-2022-0825",
"STATE": "PUBLIC",
"TITLE": "Amelia \u003c 1.0.49 - Customer+ Arbitrary Appointments Status Update"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Amelia \u2013 Events \u0026 Appointments Booking Calendar",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "1.0.49",
"version_value": "1.0.49"
}
]
}
}
]
},
"vendor_name": "Unknown"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Huli from Cymetrics"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Amelia WordPress plugin before 1.0.49 does not have proper authorisation when managing appointments, allowing any customer to update other\u0027s booking status, as well as retrieve sensitive information about the bookings, such as the full name and phone number of the person who booked it."
}
]
},
"generator": "WPScan CVE Generator",
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-863 Incorrect Authorization"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://wpscan.com/vulnerability/1a92a65f-e9df-41b5-9a1c-8e24ee9bf50e",
"refsource": "MISC",
"url": "https://wpscan.com/vulnerability/1a92a65f-e9df-41b5-9a1c-8e24ee9bf50e"
},
{
"name": "https://plugins.trac.wordpress.org/changeset/2693545",
"refsource": "CONFIRM",
"url": "https://plugins.trac.wordpress.org/changeset/2693545"
}
]
},
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2022-0825",
"datePublished": "2022-04-04T15:35:49.000Z",
"dateReserved": "2022-03-02T00:00:00.000Z",
"dateUpdated": "2024-08-02T23:40:04.464Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-0720 (GCVE-0-2022-0720)
Vulnerability from nvd – Published: 2022-03-28 17:23 – Updated: 2024-08-02 23:40
VLAI
Title
Amelia < 1.0.47 - Customer+ Arbitrary Appointments Update and Sensitive Data Disclosure
Summary
The Amelia WordPress plugin before 1.0.47 does not have proper authorisation when managing appointments, allowing any customer to update other's booking, as well as retrieve sensitive information about the bookings, such as the full name and phone number of the person who booked it.
Severity
No CVSS data available.
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://wpscan.com/vulnerability/435ef99c-9210-46… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Unknown | Amelia – Events & Appointments Booking Calendar |
Affected:
1.0.47 , < 1.0.47
(custom)
|
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T23:40:03.374Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://wpscan.com/vulnerability/435ef99c-9210-46c7-80a4-09cd4d3d00cf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Amelia \u2013 Events \u0026 Appointments Booking Calendar",
"vendor": "Unknown",
"versions": [
{
"lessThan": "1.0.47",
"status": "affected",
"version": "1.0.47",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "huli of Cymetrics"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Amelia WordPress plugin before 1.0.47 does not have proper authorisation when managing appointments, allowing any customer to update other\u0027s booking, as well as retrieve sensitive information about the bookings, such as the full name and phone number of the person who booked it."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-03-28T17:23:18.000Z",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://wpscan.com/vulnerability/435ef99c-9210-46c7-80a4-09cd4d3d00cf"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Amelia \u003c 1.0.47 - Customer+ Arbitrary Appointments Update and Sensitive Data Disclosure",
"x_generator": "WPScan CVE Generator",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "contact@wpscan.com",
"ID": "CVE-2022-0720",
"STATE": "PUBLIC",
"TITLE": "Amelia \u003c 1.0.47 - Customer+ Arbitrary Appointments Update and Sensitive Data Disclosure"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Amelia \u2013 Events \u0026 Appointments Booking Calendar",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "1.0.47",
"version_value": "1.0.47"
}
]
}
}
]
},
"vendor_name": "Unknown"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "huli of Cymetrics"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Amelia WordPress plugin before 1.0.47 does not have proper authorisation when managing appointments, allowing any customer to update other\u0027s booking, as well as retrieve sensitive information about the bookings, such as the full name and phone number of the person who booked it."
}
]
},
"generator": "WPScan CVE Generator",
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-863 Incorrect Authorization"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://wpscan.com/vulnerability/435ef99c-9210-46c7-80a4-09cd4d3d00cf",
"refsource": "MISC",
"url": "https://wpscan.com/vulnerability/435ef99c-9210-46c7-80a4-09cd4d3d00cf"
}
]
},
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2022-0720",
"datePublished": "2022-03-28T17:23:18.000Z",
"dateReserved": "2022-02-22T00:00:00.000Z",
"dateUpdated": "2024-08-02T23:40:03.374Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-0687 (GCVE-0-2022-0687)
Vulnerability from nvd – Published: 2022-03-21 18:55 – Updated: 2024-08-02 23:40
VLAI
Title
Amelia < 1.0.46 - Manager+ RCE
Summary
The Amelia WordPress plugin before 1.0.47 stores image blobs into actual files whose extension is controlled by the user, which may lead to PHP backdoors being uploaded onto the site. This vulnerability can be exploited by logged-in users with the custom "Amelia Manager" role.
Severity
No CVSS data available.
CWE
- CWE-434 - Unrestricted Upload of File with Dangerous Type
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://wpscan.com/vulnerability/3cf05815-9b74-44… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Unknown | Amelia – Events & Appointments Booking Calendar |
Affected:
1.0.47 , < 1.0.47
(custom)
|
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T23:40:03.132Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://wpscan.com/vulnerability/3cf05815-9b74-4491-a935-d69a0834146c"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Amelia \u2013 Events \u0026 Appointments Booking Calendar",
"vendor": "Unknown",
"versions": [
{
"lessThan": "1.0.47",
"status": "affected",
"version": "1.0.47",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "qerogram"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Amelia WordPress plugin before 1.0.47 stores image blobs into actual files whose extension is controlled by the user, which may lead to PHP backdoors being uploaded onto the site. This vulnerability can be exploited by logged-in users with the custom \"Amelia Manager\" role."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-03-21T18:55:57.000Z",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://wpscan.com/vulnerability/3cf05815-9b74-4491-a935-d69a0834146c"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Amelia \u003c 1.0.46 - Manager+ RCE",
"x_generator": "WPScan CVE Generator",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "contact@wpscan.com",
"ID": "CVE-2022-0687",
"STATE": "PUBLIC",
"TITLE": "Amelia \u003c 1.0.46 - Manager+ RCE"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Amelia \u2013 Events \u0026 Appointments Booking Calendar",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "1.0.47",
"version_value": "1.0.47"
}
]
}
}
]
},
"vendor_name": "Unknown"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "qerogram"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Amelia WordPress plugin before 1.0.47 stores image blobs into actual files whose extension is controlled by the user, which may lead to PHP backdoors being uploaded onto the site. This vulnerability can be exploited by logged-in users with the custom \"Amelia Manager\" role."
}
]
},
"generator": "WPScan CVE Generator",
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-434 Unrestricted Upload of File with Dangerous Type"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://wpscan.com/vulnerability/3cf05815-9b74-4491-a935-d69a0834146c",
"refsource": "MISC",
"url": "https://wpscan.com/vulnerability/3cf05815-9b74-4491-a935-d69a0834146c"
}
]
},
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2022-0687",
"datePublished": "2022-03-21T18:55:57.000Z",
"dateReserved": "2022-02-19T00:00:00.000Z",
"dateUpdated": "2024-08-02T23:40:03.132Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-0627 (GCVE-0-2022-0627)
Vulnerability from nvd – Published: 2022-03-21 18:55 – Updated: 2024-08-02 23:32
VLAI
Title
Amelia < 1.0.46 - Reflected Cross-Site Scripting
Summary
The Amelia WordPress plugin before 1.0.47 does not sanitize and escape the code parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
Severity
No CVSS data available.
CWE
- CWE-79 - Cross-site Scripting (XSS)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://wpscan.com/vulnerability/fd8c720a-a94a-43… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Unknown | Amelia – Events & Appointments Booking Calendar |
Affected:
1.0.47 , < 1.0.47
(custom)
|
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T23:32:46.462Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://wpscan.com/vulnerability/fd8c720a-a94a-438f-b686-3a734e3c24e4"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Amelia \u2013 Events \u0026 Appointments Booking Calendar",
"vendor": "Unknown",
"versions": [
{
"lessThan": "1.0.47",
"status": "affected",
"version": "1.0.47",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Ran Crane"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Amelia WordPress plugin before 1.0.47 does not sanitize and escape the code parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Cross-site Scripting (XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-03-21T18:55:51.000Z",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://wpscan.com/vulnerability/fd8c720a-a94a-438f-b686-3a734e3c24e4"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Amelia \u003c 1.0.46 - Reflected Cross-Site Scripting",
"x_generator": "WPScan CVE Generator",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "contact@wpscan.com",
"ID": "CVE-2022-0627",
"STATE": "PUBLIC",
"TITLE": "Amelia \u003c 1.0.46 - Reflected Cross-Site Scripting"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Amelia \u2013 Events \u0026 Appointments Booking Calendar",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "1.0.47",
"version_value": "1.0.47"
}
]
}
}
]
},
"vendor_name": "Unknown"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Ran Crane"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Amelia WordPress plugin before 1.0.47 does not sanitize and escape the code parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting."
}
]
},
"generator": "WPScan CVE Generator",
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-79 Cross-site Scripting (XSS)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://wpscan.com/vulnerability/fd8c720a-a94a-438f-b686-3a734e3c24e4",
"refsource": "MISC",
"url": "https://wpscan.com/vulnerability/fd8c720a-a94a-438f-b686-3a734e3c24e4"
}
]
},
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2022-0627",
"datePublished": "2022-03-21T18:55:51.000Z",
"dateReserved": "2022-02-16T00:00:00.000Z",
"dateUpdated": "2024-08-02T23:32:46.462Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-0616 (GCVE-0-2022-0616)
Vulnerability from nvd – Published: 2022-03-21 18:55 – Updated: 2024-08-02 23:32
VLAI
Title
Amelia < 1.0.46 - Arbitrary Customer Deletion via CSRF
Summary
The Amelia WordPress plugin before 1.0.47 does not have CSRF check in place when deleting customers, which could allow attackers to make a logged in admin delete arbitrary customers via a CSRF attack
Severity
No CVSS data available.
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://wpscan.com/vulnerability/7c63d76e-34ca-47… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Unknown | Amelia – Events & Appointments Booking Calendar |
Affected:
1.0.47 , < 1.0.47
(custom)
|
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T23:32:46.481Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://wpscan.com/vulnerability/7c63d76e-34ca-4778-8784-437d446c16e0"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Amelia \u2013 Events \u0026 Appointments Booking Calendar",
"vendor": "Unknown",
"versions": [
{
"lessThan": "1.0.47",
"status": "affected",
"version": "1.0.47",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Muhamad Hidayat"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Amelia WordPress plugin before 1.0.47 does not have CSRF check in place when deleting customers, which could allow attackers to make a logged in admin delete arbitrary customers via a CSRF attack"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352 Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-03-21T18:55:50.000Z",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://wpscan.com/vulnerability/7c63d76e-34ca-4778-8784-437d446c16e0"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Amelia \u003c 1.0.46 - Arbitrary Customer Deletion via CSRF",
"x_generator": "WPScan CVE Generator",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "contact@wpscan.com",
"ID": "CVE-2022-0616",
"STATE": "PUBLIC",
"TITLE": "Amelia \u003c 1.0.46 - Arbitrary Customer Deletion via CSRF"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Amelia \u2013 Events \u0026 Appointments Booking Calendar",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "1.0.47",
"version_value": "1.0.47"
}
]
}
}
]
},
"vendor_name": "Unknown"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Muhamad Hidayat"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Amelia WordPress plugin before 1.0.47 does not have CSRF check in place when deleting customers, which could allow attackers to make a logged in admin delete arbitrary customers via a CSRF attack"
}
]
},
"generator": "WPScan CVE Generator",
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-352 Cross-Site Request Forgery (CSRF)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://wpscan.com/vulnerability/7c63d76e-34ca-4778-8784-437d446c16e0",
"refsource": "MISC",
"url": "https://wpscan.com/vulnerability/7c63d76e-34ca-4778-8784-437d446c16e0"
}
]
},
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2022-0616",
"datePublished": "2022-03-21T18:55:50.000Z",
"dateReserved": "2022-02-15T00:00:00.000Z",
"dateUpdated": "2024-08-02T23:32:46.481Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-0825 (GCVE-0-2022-0825)
Vulnerability from cvelistv5 – Published: 2022-04-04 15:35 – Updated: 2024-08-02 23:40
VLAI
Title
Amelia < 1.0.49 - Customer+ Arbitrary Appointments Status Update
Summary
The Amelia WordPress plugin before 1.0.49 does not have proper authorisation when managing appointments, allowing any customer to update other's booking status, as well as retrieve sensitive information about the bookings, such as the full name and phone number of the person who booked it.
Severity
No CVSS data available.
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://wpscan.com/vulnerability/1a92a65f-e9df-41… | x_refsource_MISC |
| https://plugins.trac.wordpress.org/changeset/2693545 | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Unknown | Amelia – Events & Appointments Booking Calendar |
Affected:
1.0.49 , < 1.0.49
(custom)
|
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T23:40:04.464Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://wpscan.com/vulnerability/1a92a65f-e9df-41b5-9a1c-8e24ee9bf50e"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://plugins.trac.wordpress.org/changeset/2693545"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Amelia \u2013 Events \u0026 Appointments Booking Calendar",
"vendor": "Unknown",
"versions": [
{
"lessThan": "1.0.49",
"status": "affected",
"version": "1.0.49",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Huli from Cymetrics"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Amelia WordPress plugin before 1.0.49 does not have proper authorisation when managing appointments, allowing any customer to update other\u0027s booking status, as well as retrieve sensitive information about the bookings, such as the full name and phone number of the person who booked it."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-04-04T15:35:49.000Z",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://wpscan.com/vulnerability/1a92a65f-e9df-41b5-9a1c-8e24ee9bf50e"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://plugins.trac.wordpress.org/changeset/2693545"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Amelia \u003c 1.0.49 - Customer+ Arbitrary Appointments Status Update",
"x_generator": "WPScan CVE Generator",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "contact@wpscan.com",
"ID": "CVE-2022-0825",
"STATE": "PUBLIC",
"TITLE": "Amelia \u003c 1.0.49 - Customer+ Arbitrary Appointments Status Update"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Amelia \u2013 Events \u0026 Appointments Booking Calendar",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "1.0.49",
"version_value": "1.0.49"
}
]
}
}
]
},
"vendor_name": "Unknown"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Huli from Cymetrics"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Amelia WordPress plugin before 1.0.49 does not have proper authorisation when managing appointments, allowing any customer to update other\u0027s booking status, as well as retrieve sensitive information about the bookings, such as the full name and phone number of the person who booked it."
}
]
},
"generator": "WPScan CVE Generator",
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-863 Incorrect Authorization"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://wpscan.com/vulnerability/1a92a65f-e9df-41b5-9a1c-8e24ee9bf50e",
"refsource": "MISC",
"url": "https://wpscan.com/vulnerability/1a92a65f-e9df-41b5-9a1c-8e24ee9bf50e"
},
{
"name": "https://plugins.trac.wordpress.org/changeset/2693545",
"refsource": "CONFIRM",
"url": "https://plugins.trac.wordpress.org/changeset/2693545"
}
]
},
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2022-0825",
"datePublished": "2022-04-04T15:35:49.000Z",
"dateReserved": "2022-03-02T00:00:00.000Z",
"dateUpdated": "2024-08-02T23:40:04.464Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-0720 (GCVE-0-2022-0720)
Vulnerability from cvelistv5 – Published: 2022-03-28 17:23 – Updated: 2024-08-02 23:40
VLAI
Title
Amelia < 1.0.47 - Customer+ Arbitrary Appointments Update and Sensitive Data Disclosure
Summary
The Amelia WordPress plugin before 1.0.47 does not have proper authorisation when managing appointments, allowing any customer to update other's booking, as well as retrieve sensitive information about the bookings, such as the full name and phone number of the person who booked it.
Severity
No CVSS data available.
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://wpscan.com/vulnerability/435ef99c-9210-46… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Unknown | Amelia – Events & Appointments Booking Calendar |
Affected:
1.0.47 , < 1.0.47
(custom)
|
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T23:40:03.374Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://wpscan.com/vulnerability/435ef99c-9210-46c7-80a4-09cd4d3d00cf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Amelia \u2013 Events \u0026 Appointments Booking Calendar",
"vendor": "Unknown",
"versions": [
{
"lessThan": "1.0.47",
"status": "affected",
"version": "1.0.47",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "huli of Cymetrics"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Amelia WordPress plugin before 1.0.47 does not have proper authorisation when managing appointments, allowing any customer to update other\u0027s booking, as well as retrieve sensitive information about the bookings, such as the full name and phone number of the person who booked it."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-03-28T17:23:18.000Z",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://wpscan.com/vulnerability/435ef99c-9210-46c7-80a4-09cd4d3d00cf"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Amelia \u003c 1.0.47 - Customer+ Arbitrary Appointments Update and Sensitive Data Disclosure",
"x_generator": "WPScan CVE Generator",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "contact@wpscan.com",
"ID": "CVE-2022-0720",
"STATE": "PUBLIC",
"TITLE": "Amelia \u003c 1.0.47 - Customer+ Arbitrary Appointments Update and Sensitive Data Disclosure"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Amelia \u2013 Events \u0026 Appointments Booking Calendar",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "1.0.47",
"version_value": "1.0.47"
}
]
}
}
]
},
"vendor_name": "Unknown"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "huli of Cymetrics"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Amelia WordPress plugin before 1.0.47 does not have proper authorisation when managing appointments, allowing any customer to update other\u0027s booking, as well as retrieve sensitive information about the bookings, such as the full name and phone number of the person who booked it."
}
]
},
"generator": "WPScan CVE Generator",
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-863 Incorrect Authorization"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://wpscan.com/vulnerability/435ef99c-9210-46c7-80a4-09cd4d3d00cf",
"refsource": "MISC",
"url": "https://wpscan.com/vulnerability/435ef99c-9210-46c7-80a4-09cd4d3d00cf"
}
]
},
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2022-0720",
"datePublished": "2022-03-28T17:23:18.000Z",
"dateReserved": "2022-02-22T00:00:00.000Z",
"dateUpdated": "2024-08-02T23:40:03.374Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-0687 (GCVE-0-2022-0687)
Vulnerability from cvelistv5 – Published: 2022-03-21 18:55 – Updated: 2024-08-02 23:40
VLAI
Title
Amelia < 1.0.46 - Manager+ RCE
Summary
The Amelia WordPress plugin before 1.0.47 stores image blobs into actual files whose extension is controlled by the user, which may lead to PHP backdoors being uploaded onto the site. This vulnerability can be exploited by logged-in users with the custom "Amelia Manager" role.
Severity
No CVSS data available.
CWE
- CWE-434 - Unrestricted Upload of File with Dangerous Type
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://wpscan.com/vulnerability/3cf05815-9b74-44… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Unknown | Amelia – Events & Appointments Booking Calendar |
Affected:
1.0.47 , < 1.0.47
(custom)
|
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T23:40:03.132Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://wpscan.com/vulnerability/3cf05815-9b74-4491-a935-d69a0834146c"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Amelia \u2013 Events \u0026 Appointments Booking Calendar",
"vendor": "Unknown",
"versions": [
{
"lessThan": "1.0.47",
"status": "affected",
"version": "1.0.47",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "qerogram"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Amelia WordPress plugin before 1.0.47 stores image blobs into actual files whose extension is controlled by the user, which may lead to PHP backdoors being uploaded onto the site. This vulnerability can be exploited by logged-in users with the custom \"Amelia Manager\" role."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-03-21T18:55:57.000Z",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://wpscan.com/vulnerability/3cf05815-9b74-4491-a935-d69a0834146c"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Amelia \u003c 1.0.46 - Manager+ RCE",
"x_generator": "WPScan CVE Generator",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "contact@wpscan.com",
"ID": "CVE-2022-0687",
"STATE": "PUBLIC",
"TITLE": "Amelia \u003c 1.0.46 - Manager+ RCE"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Amelia \u2013 Events \u0026 Appointments Booking Calendar",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "1.0.47",
"version_value": "1.0.47"
}
]
}
}
]
},
"vendor_name": "Unknown"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "qerogram"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Amelia WordPress plugin before 1.0.47 stores image blobs into actual files whose extension is controlled by the user, which may lead to PHP backdoors being uploaded onto the site. This vulnerability can be exploited by logged-in users with the custom \"Amelia Manager\" role."
}
]
},
"generator": "WPScan CVE Generator",
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-434 Unrestricted Upload of File with Dangerous Type"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://wpscan.com/vulnerability/3cf05815-9b74-4491-a935-d69a0834146c",
"refsource": "MISC",
"url": "https://wpscan.com/vulnerability/3cf05815-9b74-4491-a935-d69a0834146c"
}
]
},
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2022-0687",
"datePublished": "2022-03-21T18:55:57.000Z",
"dateReserved": "2022-02-19T00:00:00.000Z",
"dateUpdated": "2024-08-02T23:40:03.132Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-0627 (GCVE-0-2022-0627)
Vulnerability from cvelistv5 – Published: 2022-03-21 18:55 – Updated: 2024-08-02 23:32
VLAI
Title
Amelia < 1.0.46 - Reflected Cross-Site Scripting
Summary
The Amelia WordPress plugin before 1.0.47 does not sanitize and escape the code parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
Severity
No CVSS data available.
CWE
- CWE-79 - Cross-site Scripting (XSS)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://wpscan.com/vulnerability/fd8c720a-a94a-43… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Unknown | Amelia – Events & Appointments Booking Calendar |
Affected:
1.0.47 , < 1.0.47
(custom)
|
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T23:32:46.462Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://wpscan.com/vulnerability/fd8c720a-a94a-438f-b686-3a734e3c24e4"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Amelia \u2013 Events \u0026 Appointments Booking Calendar",
"vendor": "Unknown",
"versions": [
{
"lessThan": "1.0.47",
"status": "affected",
"version": "1.0.47",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Ran Crane"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Amelia WordPress plugin before 1.0.47 does not sanitize and escape the code parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Cross-site Scripting (XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-03-21T18:55:51.000Z",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://wpscan.com/vulnerability/fd8c720a-a94a-438f-b686-3a734e3c24e4"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Amelia \u003c 1.0.46 - Reflected Cross-Site Scripting",
"x_generator": "WPScan CVE Generator",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "contact@wpscan.com",
"ID": "CVE-2022-0627",
"STATE": "PUBLIC",
"TITLE": "Amelia \u003c 1.0.46 - Reflected Cross-Site Scripting"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Amelia \u2013 Events \u0026 Appointments Booking Calendar",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "1.0.47",
"version_value": "1.0.47"
}
]
}
}
]
},
"vendor_name": "Unknown"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Ran Crane"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Amelia WordPress plugin before 1.0.47 does not sanitize and escape the code parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting."
}
]
},
"generator": "WPScan CVE Generator",
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-79 Cross-site Scripting (XSS)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://wpscan.com/vulnerability/fd8c720a-a94a-438f-b686-3a734e3c24e4",
"refsource": "MISC",
"url": "https://wpscan.com/vulnerability/fd8c720a-a94a-438f-b686-3a734e3c24e4"
}
]
},
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2022-0627",
"datePublished": "2022-03-21T18:55:51.000Z",
"dateReserved": "2022-02-16T00:00:00.000Z",
"dateUpdated": "2024-08-02T23:32:46.462Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-0616 (GCVE-0-2022-0616)
Vulnerability from cvelistv5 – Published: 2022-03-21 18:55 – Updated: 2024-08-02 23:32
VLAI
Title
Amelia < 1.0.46 - Arbitrary Customer Deletion via CSRF
Summary
The Amelia WordPress plugin before 1.0.47 does not have CSRF check in place when deleting customers, which could allow attackers to make a logged in admin delete arbitrary customers via a CSRF attack
Severity
No CVSS data available.
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://wpscan.com/vulnerability/7c63d76e-34ca-47… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Unknown | Amelia – Events & Appointments Booking Calendar |
Affected:
1.0.47 , < 1.0.47
(custom)
|
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T23:32:46.481Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://wpscan.com/vulnerability/7c63d76e-34ca-4778-8784-437d446c16e0"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Amelia \u2013 Events \u0026 Appointments Booking Calendar",
"vendor": "Unknown",
"versions": [
{
"lessThan": "1.0.47",
"status": "affected",
"version": "1.0.47",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Muhamad Hidayat"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Amelia WordPress plugin before 1.0.47 does not have CSRF check in place when deleting customers, which could allow attackers to make a logged in admin delete arbitrary customers via a CSRF attack"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352 Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-03-21T18:55:50.000Z",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://wpscan.com/vulnerability/7c63d76e-34ca-4778-8784-437d446c16e0"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Amelia \u003c 1.0.46 - Arbitrary Customer Deletion via CSRF",
"x_generator": "WPScan CVE Generator",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "contact@wpscan.com",
"ID": "CVE-2022-0616",
"STATE": "PUBLIC",
"TITLE": "Amelia \u003c 1.0.46 - Arbitrary Customer Deletion via CSRF"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Amelia \u2013 Events \u0026 Appointments Booking Calendar",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "1.0.47",
"version_value": "1.0.47"
}
]
}
}
]
},
"vendor_name": "Unknown"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Muhamad Hidayat"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Amelia WordPress plugin before 1.0.47 does not have CSRF check in place when deleting customers, which could allow attackers to make a logged in admin delete arbitrary customers via a CSRF attack"
}
]
},
"generator": "WPScan CVE Generator",
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-352 Cross-Site Request Forgery (CSRF)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://wpscan.com/vulnerability/7c63d76e-34ca-4778-8784-437d446c16e0",
"refsource": "MISC",
"url": "https://wpscan.com/vulnerability/7c63d76e-34ca-4778-8784-437d446c16e0"
}
]
},
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2022-0616",
"datePublished": "2022-03-21T18:55:50.000Z",
"dateReserved": "2022-02-15T00:00:00.000Z",
"dateUpdated": "2024-08-02T23:32:46.481Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}