Bookingpress
CVE-2023-50841
HIGH
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
Lifecycle Timeline
1DescriptionCVE.org
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Repute Infosystems BookingPress - Appointment Booking Calendar Plugin and Online Scheduling Plugin.This issue affects BookingPress - Appointment Booking Calendar Plugin and Online Scheduling Plugin: from n/a through 1.0.72.
AnalysisAI
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Repute Infosystems BookingPress - Appointment Booking Calendar Plugin and Online Scheduling. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified as SQL Injection (CWE-89), which allows attackers to execute arbitrary SQL commands against the database. Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Repute Infosystems BookingPress - Appointment Booking Calendar Plugin and Online Scheduling Plugin.0.72. Affected products include: Reputeinfosystems Bookingpress. Version information: through 1.0.72..
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Use parameterized queries/prepared statements. Never concatenate user input into SQL. Apply least-privilege database permissions.
More in Bookingpress
View allThe BookingPress WordPress plugin before 1.0.11 fails to properly sanitize user supplied POST data before it is used in
Authenticated arbitrary file upload in the BookingPress WordPress plugin (versions through 1.0.87) enables remote code e
The BookingPress - Appointment Booking Calendar Plugin and Online Scheduling Plugin plugin for WordPress is vulnerable t
The BookingPress - Appointment Booking Calendar Plugin and Online Scheduling Plugin plugin for WordPress is vulnerable t
Improper Authentication vulnerability in Repute Infosystems BookingPress allows Accessing Functionality Not Properly Con
The BookingPress plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation on the
The Appointment Booking Calendar Plugin and Scheduling Plugin - BookingPress plugin for WordPress is vulnerable to SQL I
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Repute Infosystems BookingPress - Appointmen
Missing Authorization vulnerability in Repute Infosystems BookingPress.0.82. Rated medium severity (CVSS 5.3), this vuln
Authorization Bypass Through User-Controlled Key vulnerability in Repute Infosystems BookingPress.0.81. Rated medium sev
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today