6.5

CVE-2023-38520

WordPress Pinpoint Booking System plugin <= 2.9.9.3.4 - Parameter Tampering

Pinpoint Booking System <= 2.9.9.3.4 - Content Spoofing

External Control of Assumed-Immutable Web Parameter vulnerability in PINPOINT.WORLD Pinpoint Booking System allows Functionality Misuse.This issue affects Pinpoint Booking System: from n/a through 2.9.9.3.4.
Mögliche Gegenmaßnahme
Pinpoint Booking System – Version 2: Update to version 2.9.9.3.5, or a newer patched version
Daten sind bereitgestellt durch das CVE Programm von Authorized Data Publishers (ADP) (Unstrukturiert)
Herstellerpinpoint
≫
Produkt pinpoint_booking_system
Default Statusunknown
Version <= 2.9.9.3.4
Version 0
Status affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt Pinpoint Booking System – Version 2
Version *-2.9.9.3.4
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.4% 0.313
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
audit@patchstack.com 6.5 3.9 2.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CWE-472 External Control of Assumed-Immutable Web Parameter

The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable, such as hidden form fields.

https://patchstack.com/database/vulnerability/booking-system/wordpress-pinpoint-booking-system-plugin-2-9-9-3-4-parameter-tampering?_s_id=cve
https://www.wordfence.com/threat-intel/vulnerabilities/id/6ad895db-5fe9-419b-8884-9a840bd350f6
Third Party Advisory