tms-outsource vulnerabilities and exploits

(subscribe to this query)

6.1

CVSSv3

The Amelia WordPress plugin prior to 1.0.47 does not sanitize and escape the code parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.

Tms-outsource Amelia

5.4

CVSSv3

The Amelia WordPress plugin prior to 1.0.48 does not have proper authorisation when handling Amelia SMS service, allowing any customer to send paid test SMS notification as well as retrieve sensitive information about the admin, such as the email, account balance and payment hist...

Tms-outsource Amelia

5.4

CVSSv3

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TMS Booking for Appointments and Events Calendar – Amelia allows Stored XSS.This issue affects Booking for Appointments and Events Calendar – Amelia: from n...

Tms-outsource Amelia

7.2

CVSSv3

The wpDataTables WordPress plugin prior to 2.1.66 does not validate the "Serialized PHP array" input data before deserializing the data. This allows admins to deserialize arbitrary data which may lead to remote code execution if a suitable gadget chain is present on the...

Tms-outsource Wpdatatables

6.1

CVSSv3

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in TMS Booking for Appointments and Events Calendar – Amelia plugin <= 1.0.75 versions.

Tms-outsource Amelia

6.1

CVSSv3

Cross-site scripting vulnerability in Appointment and Event Booking Calendar for WordPress - Amelia versions before 1.0.76 allows a remote unauthenticated malicious user to inject an arbitrary script by having a user who is logging in the WordPress where the product is installed ...

Tms-outsource Amelia

5.4

CVSSv3

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in TMS-Plugins wpDataTables plugin <= 2.1.49 versions.

Tms-outsource Wpdatatables

4.3

CVSSv3

The Amelia WordPress plugin prior to 1.0.47 does not have CSRF check in place when deleting customers, which could allow malicious users to make a logged in admin delete arbitrary customers via a CSRF attack

Tms-outsource Amelia

8.8

CVSSv3

The Amelia WordPress plugin prior to 1.0.47 stores image blobs into actual files whose extension is controlled by the user, which may lead to PHP backdoors being uploaded onto the site. This vulnerability can be exploited by logged-in users with the custom "Amelia Manager&qu...

Tms-outsource Amelia

5.4

CVSSv3

The Amelia WordPress plugin prior to 1.0.47 does not have proper authorisation when managing appointments, allowing any customer to update other's booking, as well as retrieve sensitive information about the bookings, such as the full name and phone number of the person who ...

Tms-outsource Amelia

Get Started

1 2 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook