BF
Product
Booking for Appointments and Events Calendar – Amelia
13
CVEs
0
On KEV
8.8
Max CVSS
0
New 30D
Severity mix
Critical 0High 3Medium 10Low 0
Watch
Add Booking for Appointments and Events Calendar – Amelia to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-5465 | 8.8 | Apr 7 | Amelia <= 2.1.3 - Insecure Direct Object Reference to Authenticated (Employee+) Privilege Escalation via 'externalId' Parameter Affected: through 2.1.3 |
| CVE-2026-2931 | 8.8 | Mar 26 | Amelia Booking <= 9.1.2 - Authenticated (Customer+) Insecure Direct Object Reference to Arbitrary User Password Change Affected: through 9.1.2 |
| CVE-2025-12482 | 7.5 | Nov 16 | Booking for Appointments and Events Calendar – Amelia <= 1.2.35 - Unauthenticated SQL Injection via search Affected: through 1.2.35 |
| CVE-2026-4668 | 6.5 | Mar 31 | Amelia <= 2.1.2 - Authenticated (Manager+) SQL Injection via 'sort' Parameter Affected: through 2.1.2 |
| CVE-2024-6332 | 6.5 | Sep 5 | Booking for Appointments and Events Calendar – Amelia Premium <= 7.7 and Lite <= 1.2.4 - Missing Authorization to Sensitive Information Exposure Affected: through 1.2.4 |
| CVE-2024-1484 | 6.1 | Mar 13 | Booking for Appointments and Events Calendar – Amelia <= 1.0.98 - Reflected Cross-Site Scripting Affected: through 1.0.98 |
| CVE-2023-6808 | 5.4 | Feb 5 | Booking for Appointments and Events Calendar – Amelia <= 1.0.93 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode Affected: through 1.0.93 |
| CVE-2022-0834 | 5.4 | Mar 23 | Amelia <= 1.0.46 - Stored Cross Site Scripting via lastName Affected: through 1.0.46 |
| CVE-2026-6449 | 5.3 | May 2 | Booking for Appointments and Events Calendar – Amelia <= 2.1.2 - Unauthenticated Authorization Bypass via Remote Approval Endpoint Affected: through 2.1.2 |
| CVE-2025-14720 | 5.3 | Jan 9 | Booking for Appointments and Events Calendar – Amelia <= 1.2.38 - Missing Authorization to Unauthenticated Multiple AJAX Actions Affected: through 1.2.38 |
| CVE-2025-2578 | 5.3 | Mar 28 | Booking for Appointments and Events Calendar – Amelia <= 1.2.19 - Unauthenticated Full Path Disclosure Affected: through 1.2.19 |
| CVE-2024-6552 | 5.3 | Aug 8 | Booking for Appointments and Events Calendar – Amelia <= 1.2 - Unauthenticated Full Path Disclosure Affected: through 1.2 |
| CVE-2024-6225 | 4.8 | Jun 21 | Amelia <= 1.1.5 & Amelia (Pro) <= 7.5.1 - Authenticated (Admin+) Stored Cross-Site Scripting Affected: through 1.1.5 |
Showing 13