ME
Vendor
melograno
7
CVEs
0
On KEV
1
New 30D
Products
TI8.8
The Innovative Form Builder – IvyForms
melograno
1 CVEs0 on KEV1 new
BF9.8
Booking for Appointments and Events Calendar – Amelia
melograno
6 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-109384 New | TI The Innovative Form Builder – IvyForms melograno | 8.8 | Oct 28 | The Innovative Form Builder <= 1.5.1 - Authenticated (Custom+) Arbitrary File Upload via 'allowedFileExtensions' Configuration + Public /form/submission/ Multipart Upload |
| CVE-2026-14311 | BF Booking for Appointments and Events Calendar – Amelia melograno | 5.4 | Sep 17 | Booking for Appointments and Events Calendar – Amelia (Premium) <= 2.4.4 - Authenticated (Custom+) Missing Authorization to Limited Account Takeover |
| CVE-2026-16582 | BF Booking for Appointments and Events Calendar – Amelia melograno | 5.3 | Sep 17 | Booking for Appointments and Events Calendar - Amelia <= 2.4.5 - Missing Authorization to Unauthenticated Payment Bypass |
| CVE-2026-10148 | BF Booking for Appointments and Events Calendar – Amelia melograno | 6.4 | Sep 12 | Booking for Appointments and Events Calendar – Amelia <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'load_manually' Parameter |
| CVE-2026-9055 | BF Booking for Appointments and Events Calendar – Amelia melograno | 9.8 | Sep 2 | Booking for Appointments and Events Calendar – Amelia (Premium) 8.0 - 9.6.2 - Unauthenticated Privilege Escalation to Administrator via 'externalId' |
| CVE-2026-6286 | BF Booking for Appointments and Events Calendar – Amelia melograno | 7.2 | Aug 28 | Booking for Appointments and Events Calendar <= 2.2 - Unauthenticated Stored Cross-Site Scripting via Customer Name Fields in Booking Submission |
| CVE-2026-14782 | BF Booking for Appointments and Events Calendar – Amelia melograno | 4.9 | Jul 16 | Booking for Appointments and Events Calendar – Amelia <= 2.4.3 - Authenticated (Custom+) SQL Injection via Customer Import |