What’s Vulnerable › Products

ameliabooking Booking for Appointments and Events Calendar – Amelia vulnerabilities

7 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 7 published in the last 12 months.

Check whether your ameliabooking Booking for Appointments and Events Calendar – Amelia version is affected

Latest ameliabooking Booking for Appointments and Events Calendar – Amelia vulnerabilities

• CVE-2026-6449 — Booking for Appointments and Events Calendar – Amelia <= 2.1.2 - Unauthenticated Authorization Bypass via Remote Approval Endpoint (CVSS 5.3)
• CVE-2026-5465 — Amelia <= 2.1.3 - Insecure Direct Object Reference to Authenticated (Employee+) Privilege Escalation via 'externalId' Parameter (CVSS 8.8)
• CVE-2026-4668 — Amelia <= 2.1.2 - Authenticated (Manager+) SQL Injection via 'sort' Parameter (CVSS 6.5)
• CVE-2026-2931 — Amelia Booking <= 9.1.2 - Authenticated (Customer+) Insecure Direct Object Reference to Arbitrary User Password Change (CVSS 8.8)
• CVE-2025-14720 — Booking for Appointments and Events Calendar – Amelia <= 1.2.38 - Missing Authorization to Unauthenticated Multiple AJAX Actions (CVSS 5.3)
• CVE-2025-12482 — Booking for Appointments and Events Calendar – Amelia <= 1.2.35 - Unauthenticated SQL Injection via search (CVSS 7.5)
• CVE-2025-2578 — Booking for Appointments and Events Calendar – Amelia <= 1.2.19 - Unauthenticated Full Path Disclosure (CVSS 5.3)