CommonsBooking < 2.6.8 - SQL Injection
The plugin does not sanitise and escape the location parameter of the calendar_data AJAX action (available to unauthenticated users) before it is used in dynamically constructed SQL queries, leading to an unauthenticated SQL injection.
commonsbookingPoC 已收录
CVSS9.8EPSS 60.6%