Tms
Monthly
SQL injection in the TMS Amelia booking plugin for WordPress, affecting versions through 2.4.11, lets remote attackers influence SQL queries in the plugin, with the authoritative assessment emphasizing high confidentiality impact and lower integrity and availability impact. The vulnerable endpoint or parameter is not disclosed, and the provided data contains no public exploit code or CISA KEV entry. The reported CVSS is 9.3, while the assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L, indicating network-reachable, unauthenticated exploitation with no user interaction once a vulnerable Amelia installation is present.
Remote unauthenticated attackers can exploit a missing authorization flaw (CWE-862) in the TMS Amelia WordPress booking plugin versions up to and including 2.4.10, allowing unauthorized modification of data on affected sites (CVSS 7.5, integrity-only impact). The vulnerability stems from an endpoint that fails to enforce proper access control, and no public exploit code has been identified at time of analysis; WordPress installations running the plugin and reachable over the network are at risk.
SQL injection in the wpDataTables WordPress plugin versions 7.3.6 and earlier allows unauthenticated remote attackers to inject crafted SQL into backend database queries, with CVSS 9.3 reflecting a scope-changed impact that reaches beyond the plugin's own data context. The CVSS vector indicates high confidentiality impact and low availability impact with no integrity impact, suggesting the flaw is primarily useful for extracting sensitive WordPress data (including credentials and PII) rather than tampering with records. No public exploit identified at time of analysis, but Patchstack's disclosure and the unauthenticated network attack vector make this a high-priority issue for any site running the plugin.
Privilege escalation in the Amelia booking plugin for WordPress (versions 2.3 and earlier) allows an authenticated low-privileged user (Subscriber role) to gain higher WordPress privileges. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) indicates a network-reachable flaw exploitable with only minimal account access, yielding high impact to confidentiality, integrity, and availability. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthenticated sensitive data exposure in the Amelia (Amelia Booking) WordPress plugin versions 2.2 and earlier allows remote attackers to retrieve protected information without credentials, per a Patchstack advisory. With a CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) and CWE-201 classification, the flaw is network-reachable and trivially triggerable, though no public exploit identified at time of analysis and no CISA KEV listing.
Missing authorization (CWE-862) in the TMS Amelia WordPress booking plugin, affecting versions through 2.4.10, lets remote unauthenticated attackers reach functionality that should require proper access-control checks, producing a low integrity impact with no confidentiality or availability loss (CVSS 5.3, PR:N/UI:N). Any WordPress site running a vulnerable Amelia version is potentially exposed, though the sources do not identify the specific endpoint or configuration that must be reachable, and whether a non-default setup is required is not described. A public PoC reference exists in the Patchstack advisory; it is not verified as working exploit code, and there is no CISA KEV confirmation of active exploitation.
Stored cross-site scripting in the TMS Amelia WordPress booking plugin (all versions through 2.4.12) allows an attacker holding a low-privilege authenticated account on the target site to persist script payloads that execute when another user - typically a higher-privileged operator or administrator - views the affected page. Rated CVSS 6.5 (CWE-79) with scope change (S:C), the flaw can read and alter limited data in the victim's browser context; exploitation is constrained by the need for an account (PR:L) and victim interaction (UI:R). Patchstack is the reporting source, no public exploit code or in-the-wild activity is identified in the available data, and the priority label is 'this_month'.
Missing authorization in the Amelia WordPress booking plugin (TMS Amelia) through version 2.4.10 allows unauthenticated remote attackers to tamper with restricted plugin actions due to insufficient access control checks. This medium-severity flaw (CVSS 5.3, CWE-862) carries only limited integrity impact (I:L) with no effect on confidentiality or availability, and no public exploit or active exploitation has been identified at time of analysis. Affected are WordPress sites running the plugin at version 2.4.10 or earlier; the issue requires no authentication, user interaction, or non-default configuration per the CVSS vector.
Broken access control in the Amelia booking plugin for WordPress (versions up to and including 2.2) allows low-privileged subscriber-level users to perform unauthorized high-integrity actions within the booking system. The flaw stems from missing authorization checks (CWE-862), permitting registered users - typically clients or end-users of the booking portal - to interact with data or functionality restricted to higher roles such as managers or administrators. No public exploit has been identified at time of analysis, and KEV listing is absent, but the low attack complexity and network accessibility make this a straightforward target once a subscriber account is obtained.
TMS v2.28.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /TMS/admin/setting/mail/createorupdate. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in the TMS Amelia booking plugin for WordPress, affecting versions through 2.4.11, lets remote attackers influence SQL queries in the plugin, with the authoritative assessment emphasizing high confidentiality impact and lower integrity and availability impact. The vulnerable endpoint or parameter is not disclosed, and the provided data contains no public exploit code or CISA KEV entry. The reported CVSS is 9.3, while the assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L, indicating network-reachable, unauthenticated exploitation with no user interaction once a vulnerable Amelia installation is present.
Remote unauthenticated attackers can exploit a missing authorization flaw (CWE-862) in the TMS Amelia WordPress booking plugin versions up to and including 2.4.10, allowing unauthorized modification of data on affected sites (CVSS 7.5, integrity-only impact). The vulnerability stems from an endpoint that fails to enforce proper access control, and no public exploit code has been identified at time of analysis; WordPress installations running the plugin and reachable over the network are at risk.
SQL injection in the wpDataTables WordPress plugin versions 7.3.6 and earlier allows unauthenticated remote attackers to inject crafted SQL into backend database queries, with CVSS 9.3 reflecting a scope-changed impact that reaches beyond the plugin's own data context. The CVSS vector indicates high confidentiality impact and low availability impact with no integrity impact, suggesting the flaw is primarily useful for extracting sensitive WordPress data (including credentials and PII) rather than tampering with records. No public exploit identified at time of analysis, but Patchstack's disclosure and the unauthenticated network attack vector make this a high-priority issue for any site running the plugin.
Privilege escalation in the Amelia booking plugin for WordPress (versions 2.3 and earlier) allows an authenticated low-privileged user (Subscriber role) to gain higher WordPress privileges. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) indicates a network-reachable flaw exploitable with only minimal account access, yielding high impact to confidentiality, integrity, and availability. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthenticated sensitive data exposure in the Amelia (Amelia Booking) WordPress plugin versions 2.2 and earlier allows remote attackers to retrieve protected information without credentials, per a Patchstack advisory. With a CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) and CWE-201 classification, the flaw is network-reachable and trivially triggerable, though no public exploit identified at time of analysis and no CISA KEV listing.
Missing authorization (CWE-862) in the TMS Amelia WordPress booking plugin, affecting versions through 2.4.10, lets remote unauthenticated attackers reach functionality that should require proper access-control checks, producing a low integrity impact with no confidentiality or availability loss (CVSS 5.3, PR:N/UI:N). Any WordPress site running a vulnerable Amelia version is potentially exposed, though the sources do not identify the specific endpoint or configuration that must be reachable, and whether a non-default setup is required is not described. A public PoC reference exists in the Patchstack advisory; it is not verified as working exploit code, and there is no CISA KEV confirmation of active exploitation.
Stored cross-site scripting in the TMS Amelia WordPress booking plugin (all versions through 2.4.12) allows an attacker holding a low-privilege authenticated account on the target site to persist script payloads that execute when another user - typically a higher-privileged operator or administrator - views the affected page. Rated CVSS 6.5 (CWE-79) with scope change (S:C), the flaw can read and alter limited data in the victim's browser context; exploitation is constrained by the need for an account (PR:L) and victim interaction (UI:R). Patchstack is the reporting source, no public exploit code or in-the-wild activity is identified in the available data, and the priority label is 'this_month'.
Missing authorization in the Amelia WordPress booking plugin (TMS Amelia) through version 2.4.10 allows unauthenticated remote attackers to tamper with restricted plugin actions due to insufficient access control checks. This medium-severity flaw (CVSS 5.3, CWE-862) carries only limited integrity impact (I:L) with no effect on confidentiality or availability, and no public exploit or active exploitation has been identified at time of analysis. Affected are WordPress sites running the plugin at version 2.4.10 or earlier; the issue requires no authentication, user interaction, or non-default configuration per the CVSS vector.
Broken access control in the Amelia booking plugin for WordPress (versions up to and including 2.2) allows low-privileged subscriber-level users to perform unauthorized high-integrity actions within the booking system. The flaw stems from missing authorization checks (CWE-862), permitting registered users - typically clients or end-users of the booking portal - to interact with data or functionality restricted to higher roles such as managers or administrators. No public exploit has been identified at time of analysis, and KEV listing is absent, but the low attack complexity and network accessibility make this a straightforward target once a subscriber account is obtained.
TMS v2.28.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /TMS/admin/setting/mail/createorupdate. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.