Melograno vulnerabilities

Products

• Booking For Appointments And Events Calendar – Amelia 9

Newest

• ameliabooking booking for appointments and events calendar – amelia Booking for Appointments and Events Calendar <= 9.9.1 - Missing Authorization to Unauthenticated Arbitrary Event Attendee Data Exposure via '/report/event/attendees' Endpoint CVE-2026-107616 7.5 HighNovember 7, 2026
• ameliabooking booking for appointments and events calendar – amelia Booking for Appointments and Events Calendar <= 9.9.1 - Missing Authorization to Authenticated (Custom+) Sensitive Information Disclosure via '/report/event/bookings' Endpoint CVE-2026-104992 6.5 MediumNovember 7, 2026
• ameliabooking booking for appointments and events calendar – amelia Booking for Appointments and Events Calendar <= 2.4.12 - Unauthenticated Sensitive Information Exposure in 'page' Parameter CVE-2026-103915 5.3 MediumOctober 31, 2026
• melograno the innovative form builder – ivyforms The Innovative Form Builder <= 1.5.1 - Authenticated (Custom+) Arbitrary File Upload via 'allowedFileExtensions' Configuration + Public /form/submission/ Multipart Upload CVE-2026-109384 Public exploit 8.8 HighOctober 28, 2026
• ameliabooking booking for appointments and events calendar – amelia Booking for Appointments and Events Calendar - Amelia <= 2.4.5 - Missing Authorization to Unauthenticated Payment Bypass CVE-2026-16582 5.3 MediumSeptember 17, 2026
• ameliabooking booking for appointments and events calendar – amelia Booking for Appointments and Events Calendar – Amelia (Premium) <= 2.4.4 - Authenticated (Custom+) Missing Authorization to Limited Account Takeover CVE-2026-14311 5.4 MediumSeptember 17, 2026
• ameliabooking booking for appointments and events calendar – amelia Booking for Appointments and Events Calendar – Amelia <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'load_manually' Parameter CVE-2026-10148 6.4 MediumSeptember 12, 2026
• ameliabooking booking for appointments and events calendar – amelia Booking for Appointments and Events Calendar – Amelia (Premium) 8.0 - 9.6.2 - Unauthenticated Privilege Escalation to Administrator via 'externalId' CVE-2026-9055 Public exploit 9.8 CriticalSeptember 2, 2026
• ameliabooking booking for appointments and events calendar – amelia Booking for Appointments and Events Calendar <= 2.2 - Unauthenticated Stored Cross-Site Scripting via Customer Name Fields in Booking Submission CVE-2026-6286 7.2 HighAugust 28, 2026
• ameliabooking booking for appointments and events calendar – amelia Booking for Appointments and Events Calendar – Amelia <= 2.4.3 - Authenticated (Custom+) SQL Injection via Customer Import CVE-2026-14782 4.9 MediumJuly 16, 2026