WP BASE Booking - Reflected XSS

WP BASE Booking of Appointments, Services and Events WordPress plugin 5.0.0 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before output, letting attackers execute malicious scripts in high privilege users' browsers, exploit requires victim to...

Malware in down-lo-ad-now-zip-mp3-12737-talking-book-grhl4-lwvpqw

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious Package

Overview down-lo-ad-now-zip-mp3-12737-talking-book-grhl4-lwvpqw is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between...

CVE-2025-12737

creationtimestamp| type| source ---|---|--- 2026-09-03 14:39:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/j3axzhydvc5uy 2026-09-13 05:07:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mvet6yo6op2u...

CVE-2017-12737

creationtimestamp| type| source ---|---|--- 2026-07-26 07:01:57+00:00| seen| https://t.me/KaitNews/6360 2026-07-27 00:01:38+00:00| seen| https://t.me/KaitNews/6360 2026-07-29 07:00:09+00:00| published-proof-of-concept| https://t.me/KaitNews/6360 2026-07-30 00:03:11+00:00|...

CVE-2020-12737

An issue was discovered in Maxum Rumpus before 8.2.12 on macOS. Authenticated users can perform a path traversal using double escaped characters, enabling read access to arbitrary files on the server...

CVE-2019-12737

UserHashedTableAuth in JetBrains Ktor framework before 1.2.0-rc uses a One-Way Hash with a Predictable Salt for storing user credentials...

CVE-2024-12737

The WP BASE Booking of Appointments, Services and Events WordPress plugin before 5.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-12737

creationtimestamp| type| source ---|---|--- 2025-02-26 06:25:25+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/5471 2026-02-11 14:53:32+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2024/CVE-2024-12737.yaml 2026-02-12 21:03:16+00:00| seen|...

CVE-2024-12737 WP BASE Booking of Appointments, Services and Events < 5.0.0 - Reflected XSS

The WP BASE Booking of Appointments, Services and Events WordPress plugin before 5.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-12737

The WP BASE Booking of Appointments, Services and Events WordPress plugin versions prior to 5.0.0 is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is a failure to properly sanitise and escape a parameter before it is outputted back onto the page. An attacker can exploit this...

CVE-2024-12737 WP BASE Booking of Appointments, Services and Events < 5.0.0 - Reflected XSS

The WP BASE Booking of Appointments, Services and Events WordPress plugin before 5.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2020-12737

An issue was discovered in Maxum Rumpus before 8.2.12 on macOS. Authenticated users can perform a path traversal using double escaped characters, enabling read access to arbitrary files on the server...

CVE-2020-12737

An issue was discovered in Maxum Rumpus before 8.2.12 on macOS. Authenticated users can perform a path traversal using double escaped characters, enabling read access to arbitrary files on the server...

CVE-2020-12737

CVE-2020-12737 affects Maxum Rumpus on macOS prior to version 8.2.12. The issue is a path traversal vulnerability where authenticated users can use double-escaped characters to read arbitrary files on the server. Impact is read access to sensitive files; no other compromises are specified. Remedi...

CVE-2019-12737

UserHashedTableAuth in JetBrains Ktor framework before 1.2.0-rc uses a One-Way Hash with a Predictable Salt for storing user credentials...

CVE-2019-12737

UserHashedTableAuth in JetBrains Ktor framework before 1.2.0-rc uses a One-Way Hash with a Predictable Salt for storing user credentials...

CVE-2019-12737

UserHashedTableAuth in JetBrains Ktor framework before 1.2.0-rc uses a One-Way Hash with a Predictable Salt for storing user credentials...

CVE-2017-12737

The CVE-2017-12737 entry applies to Siemens SICAM RTUs SM-2556 COM Modules (firmware variants ENOS00, ERAC00, ETA2, ETLS00, MODi00, DNPi00). The vulnerability arises from a missing authentication for a critical function: the integrated web server (port 80) could allow unauthenticated remote acces...

Siemens SICAM RTUs SM-2556 COM Modules XSS / Bypass / Code Execution Vulnerabilities

Siemens SICAM RTUs SM-2556 COM modules firmware variants ENOS00, ERAC00, ETA2, ETLS00, MODi00, and DNPi00 suffer from authentication bypass, code execution, and cross site scripting vulnerabilities. ======================================================================= title: Authentication...