CVE-2022-1006

CVE-2022-1006: Advanced Booking Calendar < 1.7.1 - Admin+ SQLi

Vendor Unknown

Product Advanced Booking Calendar

Weakness CWE-89 · SQLi

Published April 11, 2022

Last update August 2, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The Advanced Booking Calendar WordPress plugin before 1.7.1 does not sanitise and escape the id parameter when editing Calendars, which could allow high privilege users such as admin to perform SQL injection attacks

Key dates

02Disclosure timeline

April 11, 2022 CVE published

August 2, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-1006 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/89.html

Related vulnerabilities

04Related CVE

CVE-2024-3348 SourceCodester Aplaya Beach Resort Online Reservation System index.php sql injection CVE-2023-3810 Hospital Management System patientappointment.php sql injection CVE-2026-32272 Craft Commerce: Blind SQL Injection via hasVariant/hasProduct CVE-2026-7194 SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection CVE-2023-2039 novel-plus sql injection