{"affected":[{"affectedData":[{"product":"Advanced Booking Calendar","vendor":"Unknown","versions":[{"lessThan":"1.7.1","status":"affected","version":"1.7.1","versionType":"custom"}]}],"source":"contact@wpscan.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:elbtide:advanced_booking_calendar:*:*:*:*:*:wordpress:*:*","matchCriteriaId":"1E028221-2823-457E-9390-A878418E1B89","versionEndExcluding":"1.7.1","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Advanced Booking Calendar WordPress plugin before 1.7.1 does not sanitise and escape the id parameter when editing Calendars, which could allow high privilege users such as admin to perform SQL injection attacks"},{"lang":"es","value":"El plugin Advanced Booking Calendar de WordPress versiones anteriores a 1.7.1, no sanea y escapa del parámetro id cuando se editan los Calendarios, lo que podría permitir a usuarios con altos privilegios, como el administrador, llevar a cabo ataques de inyección SQL"}],"id":"CVE-2022-1006","lastModified":"2026-06-17T04:21:38.073","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"MEDIUM","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"SINGLE","availabilityImpact":"PARTIAL","baseScore":6.5,"confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","version":"2.0"},"exploitabilityScore":8.0,"impactScore":6.4,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"nvd@nist.gov","type":"Primary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2022-04-11T15:15:08.930","references":[{"source":"contact@wpscan.com","tags":["Patch","Third Party Advisory"],"url":"https://plugins.trac.wordpress.org/changeset/2695427"},{"source":"contact@wpscan.com","tags":["Exploit","Patch","Third Party Advisory"],"url":"https://wpscan.com/vulnerability/c5569317-b8c8-4524-8375-3e2369bdcc68"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"],"url":"https://plugins.trac.wordpress.org/changeset/2695427"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Patch","Third Party Advisory"],"url":"https://wpscan.com/vulnerability/c5569317-b8c8-4524-8375-3e2369bdcc68"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"contact@wpscan.com","type":"Secondary"}]}