CVE-2024-9504

HIGH Year: 2024
CVSS v3 Score
7.2
High
Weakness Type
CWE-434
View all →

Vulnerability Description

The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.2.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.

Related Vulnerabilities

CVE-2011-2933

HIGH
CVSS:7.2(High)

An Arbitrary File Upload vulnerability exists in admin/media/upload.php in WebsiteBaker 2.8.1 and earlier due to a failure to restrict uploaded files with .htaccess, .php4, .php5, and .phtl extensions...

CWE-4342011

CVE-2014-9619

HIGH
CVSS:7.2(High)

Unrestricted file upload vulnerability in webadmin/ajaxfilemanager/ajaxfilemanager.php in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote authenticated users with ad...

CWE-4342014

CVE-2016-6104

HIGH
CVSS:7.2(High)

IBM Tivoli Key Lifecycle Manager 2.5, and 2.6 could allow a remote attacker to upload arbitrary files, caused by the improper validation of file extensions, which could allow the attacker to execute a...

CWE-4342016

CVE-2016-9268

HIGH
CVSS:7.2(High)

Unrestricted file upload vulnerability in the Blog appearance in the "Install or upgrade manually" module in Dotclear through 2.10.4 allows remote authenticated super-administrators to execute arbitra...

CWE-4342016

CVE-2017-1000119

HIGH
CVSS:7.2(High)

October CMS build 412 is vulnerable to PHP code execution in the file upload functionality resulting in site compromise and possibly other applications on the server.

CWE-4342017

CVE-2017-11154

HIGH
CVSS:7.2(High)

Unrestricted file upload vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to create arbitrary PHP scripts via the type parameter...

CWE-4342017