CVE-2022-0739

CVE-2022-0739: BookingPress < 1.0.11 - Unauthenticated SQL Injection

Vendor Unknown

Product BookingPress – Appointments Booking Calendar Plugin and Online Scheduling Plugin

Weakness CWE-89 · SQLi

Published March 21, 2022

Last update August 2, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The BookingPress WordPress plugin before 1.0.11 fails to properly sanitize user supplied POST data before it is used in a dynamically constructed SQL query via the bookingpress_front_get_category_services AJAX action (available to unauthenticated users), leading to an unauthenticated SQL Injection

Key dates

02Disclosure timeline

March 21, 2022 CVE published

August 2, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-0739 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/89.html

Related vulnerabilities

04Related CVE

CVE-2024-33546 WordPress WZone plugin <= 14.0.10 - Arbitrary SQL Update Execution vulnerability CVE-2025-6276 Brilliance Golden Link Secondary System rentTakeInfoPage.htm sql injection CVE-2026-28805 OpenSTAManager: Time-Based Blind SQL Injection via `options[stato]` Parameter CVE-2026-33153 Tandoor Recipes's Unauthenticated Debug Parameter Leaks Full Raw SQL Queries Including Schema, Table Names, and Access Control Logic CVE-2025-3799 WCMS AnonymousController.php sql injection