Known CVE

CommonsBooking < 2.6.8 - SQL Injection

The plugin does not sanitise and escape the location parameter of the calendar_data AJAX action (available to unauthenticated users) before it is used in dynamically constructed SQL queries, leading to an unauthenticated SQL injection.

CVE-2022-0658

Critical2022CVSS 9.8CWE-89

time-based-sqli · cve2022 · wordpress · wp-plugin · wp · commonsbooking · sqli · wpscan

Verified scans run this check after you prove you own the site.

All known CVEs View the checks catalog National Vulnerability Database

Scan a website