CVE-2023-0768

Avirato hotels online booking engine <= 5.0.5 - Subscriber+ SQLi

High · published May 8, 2023

CVSS v3.1
8.8
EPSS
1%
Percentile
58.5
In the wild
Unconfirmed
What it is

The Avirato hotels online booking engine WordPress plugin through 5.0.5 does not validate and escape some of its shortcode attributes before using them in SQL statement/s, which could allow any authenticated users, such as subscriber to perform SQL Injection attacks.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00872 · 58.5th percentile
Published
2023-05-08T13:58Z
EPSS history
Timeline
  • 08 MAY 13:58Z
    Avirato hotels online booking engine <= 5.0.5 - Subscriber+ SQLi
    cvelistv5