CVE-2022-0658 — CommonsBooking < 2.6.8 - Unauthenticated SQL Injection
The CommonsBooking WordPress plugin before 2.6.8 does not sanitise and escape the location parameter of the calendar_data AJAX action (available to unauthenticated users) before…
Published: 2022-03-14 · CVSS: Unscored
The CommonsBooking WordPress plugin before 2.6.8 does not sanitise and escape the location parameter of the calendar_data AJAX action (available to unauthenticated users) before it is used in dynamically constructed SQL queries, leading to an unauthenticated SQL injection
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7