Tms-outsource Amelia
12 CVEs affecting Tms-outsource Amelia. Latest disclosed: 2024-06-21. Critical: 0, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-0687 | High | 8.8 | 2022-03-21 | The Amelia WordPress plugin before 1.0.47 stores image blobs into actual files whose extension is controlled by the user, which may lead to PHP backdoors being… |
CVE-2023-29427 | High | 7.1 | 2023-06-26 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in TMS Booking for Appointments and Events Calendar – Amelia plugin <= 1.0.75 versions. |
CVE-2023-50860 | Medium | 6.5 | 2023-12-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TMS Booking for Appointments and Events Calendar – Amelia… |
CVE-2023-6808 | Medium | 6.4 | 2024-02-05 | The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in al… |
CVE-2023-27918 | Medium | 6.1 | 2023-05-10 | Cross-site scripting vulnerability in Appointment and Event Booking Calendar for WordPress - Amelia versions prior to 1.0.76 allows a remote unauthenticated at… |
CVE-2022-0627 | Medium | 6.1 | 2022-03-21 | The Amelia WordPress plugin before 1.0.47 does not sanitize and escape the code parameter before outputting it back in an admin page, leading to a Reflected Cr… |
CVE-2022-0837 | Medium | 5.4 | 2022-04-04 | The Amelia WordPress plugin before 1.0.48 does not have proper authorisation when handling Amelia SMS service, allowing any customer to send paid test SMS noti… |
CVE-2022-0825 | Medium | 5.4 | 2022-04-04 | The Amelia WordPress plugin before 1.0.49 does not have proper authorisation when managing appointments, allowing any customer to update other's booking status… |
CVE-2022-0720 | Medium | 5.4 | 2022-03-28 | The Amelia WordPress plugin before 1.0.47 does not have proper authorisation when managing appointments, allowing any customer to update other's booking, as we… |
CVE-2024-22298 | Medium | 5.3 | 2024-06-10 | Missing Authorization vulnerability in TMS Amelia ameliabooking.This issue affects Amelia: from n/a through 1.0.98. |
CVE-2024-6225 | Medium | 4.4 | 2024-06-21 | The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions… |
CVE-2022-0616 | Medium | 4.3 | 2022-03-21 | The Amelia WordPress plugin before 1.0.47 does not have CSRF check in place when deleting customers, which could allow attackers to make a logged in admin dele… |