CVE-2025-2578
published 2025-03-28CVE-2025-2578: The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including…
PriorityP426medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
0.36%
28.3th percentile
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.2.19 via the 'wpAmeliaApiCall' function. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ameliabooking | booking_for_appointments_and_events_calendar_amelia | <= 1.2.19 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
ImageMagick has XMP profile write that triggers hang due to unbounded loop
ghsa·2025-07-23
CVE-2025-53015 [HIGH] CWE-835 ImageMagick has XMP profile write that triggers hang due to unbounded loop
ImageMagick has XMP profile write that triggers hang due to unbounded loop
### Summary
Infinite lines occur when writing during a specific XMP file conversion command
### Details
```
#0 GetXmpNumeratorAndDenominator (denominator=, numerator=, value=) at MagickCore/profile.c:2578
#1 GetXmpNumeratorAndDenominator (denominator=, numerator=, value=720000000000000) at MagickCore/profile.c:2564
#2 SyncXmpProfile (image=image@entry=0x555555bb9ea0, profile=0x555555b9d020) at MagickCore/profile.c:2605
#3 0x00005555555db5cf in SyncImageProfiles (image=image@entry=0x555555bb9ea0) at MagickCore/profile.c:2651
#4 0x0000555555798d4f in WriteImage (image_info=image_info@entry=0x555555bc2050, image=image@entry=0x555555bb9ea0, exception=exception@entry=0x555555b7bea0) at MagickCore/constitute.c:1288
#5 0x
GHSA
GHSA-v9j3-cm39-6hmg: The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and includ
ghsa_unreviewed·2025-03-28
CVE-2025-2578 [MEDIUM] CWE-200 GHSA-v9j3-cm39-6hmg: The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and includ
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.2.19 via the 'wpAmeliaApiCall' function. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://plugins.trac.wordpress.org/browser/ameliabooking/trunk/ameliabooking.php#L172https://plugins.trac.wordpress.org/browser/ameliabooking/trunk/src/Application/Commands/Entities/GetEntitiesCommandHandler.php#L127https://plugins.trac.wordpress.org/changeset/3261318/https://www.wordfence.com/threat-intel/vulnerabilities/id/6806e07b-96bf-43ad-a3ac-2105e7449e3c?source=cve
2025-03-28
Published