Vulnerabilidades

Resumen — últimos 7 días

Vulnerabilidades nuevas2704▼ 598 respecto a la semana anterior

Críticas / altas1288▼ 199 respecto a la semana anterior

Nueva explotación activa (KEV)4▼ 5 respecto a la semana anterior

Sin puntuar (sin CVSS)299▼ 211 respecto a la semana anterior

106 resultados, ordenados por fecha de publicación (más recientes primero)

CVE	Estado	Severidad	EPSS	Explotación activa	Tecnologías afectadas	Publicada ▼	Modificada	Descripción
CVE-2020-9371	Modificada	Media (4.8)	3.3%	💥 Exploit	Codepeople Appointment Booking Calendar	4/3/2020	17/6/2026	Stored XSS exists in the Appointment Booking Calendar plugin before 1.3.35 for WordPress. In the cpabc_appointments.php file, the Calendar Name input could allow attackers to inject arbitrary JavaScript or HTML.
CVE-2016-10916	Modificada	Crítica (9.8)	1.8%	—	Codepeople Appointment Booking Calendar	22/8/2019	17/6/2026	The appointment-booking-calendar plugin before 1.1.24 for WordPress has SQL injection, a different vulnerability than CVE-2015-7319.
CVE-2019-14791	Modificada	Media (6.1)	1.4%	—	Codepeople Appointment Booking Calendar	9/8/2019	17/6/2026	The Appointment Booking Calendar plugin 1.3.18 for WordPress allows XSS via the wp-admin/admin-post.php editionarea parameter.
CVE-2019-9066	Modificada	Media (5.4)	0.64%	—	PHP Appointment Booking Script Project PHP Appointment Booking Script	23/2/2019	17/6/2026	PHP Scripts Mall PHP Appointment Booking Script 3.0.3 allows HTML injection in a user profile.
CVE-2015-7320	Modificada	Media (4.3)	2.1%	—	Codepeople Appointment Booking Calendar	29/9/2015	17/6/2026	Multiple cross-site scripting (XSS) vulnerabilities in cpabc_appointments_admin_int_bookings_list.inc.php in the Appointment Booking Calendar plugin before 1.1.8 for WordPress allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2015-7319	Modificada	Alta (7.5)	2.4%	—	Codepeople Appointment Booking Calendar	29/9/2015	17/6/2026	SQL injection vulnerability in cpabc_appointments_admin_int_calendar_list.inc.php in the Appointment Booking Calendar plugin before 1.1.8 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors related to updating the username.