CVE-2023-48207

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Availability Booking Calendar 5.0 allows CSV injection via the unique ID field in the Reservations list component.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1236

Affected software

No affected versions have been published.

Timeline

Published
Dec 7, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-482086.1A Cross Site Scripting vulnerability in Availability Booking Calendar 5.0 allows an attacker to inject JavaScript via the name, plugin_sms_aCVE-2023-48215.4The Drag and Drop Multiple File Upload for WooCommerce WordPress plugin before 1.1.1 does not filter all potentially dangerous file extensioCVE-2023-482178.8Statamic is a flat-first, Laravel + Git powered CMS designed for building websites. In affected versions certain additional PHP files crafteCVE-2023-482185.3The Strapi Protected Populate Plugin protects `get` endpoints from revealing too much information. Prior to version 1.3.4, users were able tCVE-2023-482196.1TinyMCE is an open source rich text editor. A mutation cross-site scripting (mXSS) vulnerability was discovered in TinyMCE’s core undo/redo CVE-2023-48227.2Grafana is an open-source platform for monitoring and observability. The vulnerability impacts Grafana instances with several organizations,CVE-2023-482207.4Decidim is a participatory democracy framework. Starting in version 0.4.rc3 and prior to version 2.0.9 of the `devise_invitable` gem, the inCVE-2023-482218.8wire-avs provides Audio, Visual, and Signaling (AVS) functionality sure the secure messaging software Wire. Prior to versions 9.2.22 and 9.3CVE-2023-482225.4Rundeck is an open source automation service with a web console, command line tools and a WebAPI. In affected versions access to two URLs usCVE-2023-482235.9fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to version 3.3.2, the fast-jwt library does not properly prevent JWT algorCVE-2023-482249.1Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and theCVE-2023-482259.1Laf is a cloud development platform. Prior to version 1.0.0-beta.13, the control of LAF app enV is not strict enough, and in certain scenari
CVE-2023-48207: High severity, CVSS 8.8 | Vulnix