EUVD-2026-112617

The Appointment Booking Plugin WordPress plugin before 5.7.6 does not escape several booking-form step content settings before rendering them on the public booking form, allowing high-privilege users such as administrators to inject JavaScript that executes in the browser of any visitor who loads...

CVE-2023-23397-POC

CVE-2023-23397-POC Exploit POC for CVE-2023-23397 Appointment.cs : the modified file from https://github.com/Sicos1977/MsgKit/blob/master/MsgKit/Appointment.cs Exploit.cs : the code i used to replicate creating the malicious appointment . i modified the code picture in MDSEC article here :...

Doctor Appointment System 1.0 - SQL Injection

SQL injection in the expertise parameter in searchresult.php in Doctor Appointment System v1.0. id: CVE-2021-27124 info: name: Doctor Appointment System 1.0 - SQL Injection author: theamanrawat severity: medium description: | SQL injection in the expertise parameter in searchresult.php in Doctor...

Doctor Appointment System 1.0 - SQL Injection

Blind SQL injection in contactus.php in Doctor Appointment System 1.0 allows an unauthenticated attacker to insert malicious SQL queries via the comment parameter. id: CVE-2021-27315 info: name: Doctor Appointment System 1.0 - SQL Injection author: theamanrawat severity: high description: | Blind...

Doctor Appointment System 1.0 - SQL Injection

Blind SQL injection in contactus.php in Doctor Appointment System 1.0 allows an unauthenticated attacker to insert malicious SQL queries via email parameter. id: CVE-2021-27319 info: name: Doctor Appointment System 1.0 - SQL Injection author: theamanrawat severity: high description: | Blind SQL...

Bookly <=28.1 - IDOR Unauthenticated Sensitive Data Access

Bookly WordPress plugin = 28.1 contains an insecure direct object reference caused by missing validation on 'conversationid' parameter, letting unauthenticated attackers read and inject messages into any AI booking conversation, exploit requires no authentication. id: CVE-2026-89063 info: name:...

Doctor Appointment System 1.0 - SQL Injection

SQL injection in admin.php in doctor appointment system 1.0 allows an unauthenticated attacker to insert malicious SQL queries via username parameter at login page. id: CVE-2021-27314 info: name: Doctor Appointment System 1.0 - SQL Injection author: theamanrawat severity: critical description: |...

Doctor Appointment System 1.0 - SQL Injection

Blind SQL injection in contactus.php in doctor appointment system 1.0 allows an unauthenticated attacker to insert malicious SQL queries via lastname parameter. id: CVE-2021-27316 info: name: Doctor Appointment System 1.0 - SQL Injection author: theamanrawat severity: high description: | Blind SQ...

TrueBooker <= 1.0.2 - SQL Injection

The TrueBooker Appointment Booking and Scheduler Plugin. plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 1.0.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

Doctor Appointment System 1.0 - SQL Injection

Blind SQL injection in contactus.php in Doctor Appointment System 1.0 allows an unauthenticated attacker to insert malicious SQL queries via firstname parameter. id: CVE-2021-27320 info: name: Doctor Appointment System 1.0 - SQL Injection author: theamanrawat severity: high description: | Blind S...

CVE-2025-45805

CVE-2025-45805 Poc Of CVE-2025-45805 Affected Product: Doctor Appointment Management System Vendor: phpgurukul Version: 1.0 Vulnerability Type: Stored Cross-Site Scripting XSS Description: An authenticated doctor user can inject arbitrary JavaScript code into the doctor profile field name/employe...

openmeetings-calendar-save-idor

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · openmeetings-calendar-save-idor Write-up: https://abraxaslabs.tech/research/openmeetings-9-1-0-leftovers openmeetings-calendar-save-idor Class: IDOR Reach: Remote Apache OpenMeetings 9.1.0 9773c59e - Apache Software...

CVE-2026-15282

CVE-2026-15282 — Instant Appointment Mass RCE Exploit Pre-Auth filegetcontents + fileputcontents → PHP Webshell Overview CVE-2026-15282 is a critical CVSS 9.8 unauthenticated arbitrary file upload vulnerability in the Instant Appointment WordPress plugin ≤ 1.2. The addservicefront AJAX action is...

exploits

exploits Published PoCs can be found at exploitdb.com Patient Appointment Scheduler System v1.0: Inbit Messenger v4.6.0:...

CVE-2026-111727

The Appointment Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vstextsubmitbtn' parameter in all versions up to, and including, 1.4.05 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-111727

The Appointment Booking Calendar plugin for WordPress (versions up to and including 1.4.05 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping of the 'vs_text_submitbtn' parameter. Authenticated attackers with Subscriber-lev...

EUVD-2026-111577

The Appointment Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vstextsubmitbtn' parameter in all versions up to, and including, 1.4.05 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-111727 Appointment Booking Calendar <= 1.4.05 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'vs_text_submitbtn' Parameter

The Appointment Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vstextsubmitbtn' parameter in all versions up to, and including, 1.4.05 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-9830

-orange?style=for-the-badge CVE-2026-9830 — BookingPress Pro Authentication Bypass Comprehensive Cybersecurity Threat Intelligence Investigation Overview • Reports • Key Findings • Technical Details • Risk Assessment • Mitigation • References 📋 Overview CVE-2026-9830 is a critical authentication...

PT-2026-127802

The Appointment Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vs text submitbtn' parameter in all versions up to, and including, 1.4.05 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wit...