CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2016-10916 – Appointment Booking Calendar <= 1.1.23 - SQL Injection
https://notcve.org/view.php?id=CVE-2016-10916
The appointment-booking-calendar plugin before 1.1.24 for WordPress has SQL injection, a different vulnerability than CVE-2015-7319. El plugin appointment-booking-calendar versiones anteriores a 1.1.24 para WordPress, presenta una inyección SQL, una vulnerabilidad diferente de CVE-2015-7319. • https://wordpress.org/plugins/appointment-booking-calendar/#developers • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2015-7320 – Appointment Booking Calendar <= 1.1.7 - Multiple Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2015-7320
Multiple cross-site scripting (XSS) vulnerabilities in cpabc_appointments_admin_int_bookings_list.inc.php in the Appointment Booking Calendar plugin before 1.1.8 for WordPress allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. Múltiples vulnerabilidades de XSS en cpabc_appointments_admin_int_bookings_list.inc.php en el plugin Appointment Booking Calendar en versiones anteriores a 1.1.8 para WordPress, permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de vectores no especificados. WordPress Appointment Booking Calendar plugin version 1.1.7 suffers from multiple cross site scripting vulnerabilities. • http://packetstormsecurity.com/files/133743/WordPress-Appointment-Booking-Calendar-1.1.7-XSS.html http://www.securityfocus.com/archive/1/536556/100/0/threaded http://www.securityfocus.com/archive/1/536557/100/0/threaded https://wordpress.org/plugins/appointment-booking-calendar/changelog https://wpvulndb.com/vulnerabilities/8199 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2015-7319 – Appointment Booking Calendar <= 1.1.7 - SQL Injection
https://notcve.org/view.php?id=CVE-2015-7319
SQL injection vulnerability in cpabc_appointments_admin_int_calendar_list.inc.php in the Appointment Booking Calendar plugin before 1.1.8 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors related to updating the username. Vulnerabilidad de inyección SQL en cpabc_appointments_admin_int_calendar_list.inc.php en el plugin Appointment Booking Calendar en versiones anteriores a 1.1.8 para WordPress, permite a atacantes remotos ejecutar comandos SQL arbitrarios a través vectores no especificados relacionados con la actualización del nombre de usuario. • http://packetstormsecurity.com/files/133757/WordPress-Appointment-Booking-Calendar-1.1.7-SQL-Injection.html http://www.securityfocus.com/archive/1/536555/100/0/threaded https://wordpress.org/plugins/appointment-booking-calendar/changelog https://wpvulndb.com/vulnerabilities/8199 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •