WP Booking System <= 2.1.0.3 - Unauthenticated Email Log Disclosure

WP Booking System – Booking Calendar plugin for WordPress = 2.1.0.3 contains an authorization bypass caused by improper user authorization verification, letting unauthenticated attackers read stored notification emails exposing customer PII, exploit requires authenticated Subscriber-level user. i...

CVE-2026-57639

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Roland Murg WP Booking System wp-booking-system allows Reflected XSS.This issue affects WP Booking System: from n/a through 2.1.0.6...

EUVD-2026-116772

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Roland Murg WP Booking System wp-booking-system allows Reflected XSS.This issue affects WP Booking System: from n/a through 2.1.0.6...

CVE-2026-57639 WordPress WP Booking System plugin <= 2.1.0.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Roland Murg WP Booking System wp-booking-system allows Reflected XSS.This issue affects WP Booking System: from n/a through 2.1.0.6...

CVE-2026-57639

The Roland Murg WP Booking System (wp-booking-system) WordPress plugin is vulnerable to a Reflected Cross-Site Scripting (XSS) flaw due to improper neutralization of input during web page generation. This issue impacts versions from n/a through 2.1.0.6 . While the specific technical root cause or...

WordPress WP Booking System plugin <= 2.1.0.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Sebi2030 in WordPress Plugin WP Booking System versions = 2.1.0.6...

CVE-2025-46181-XSS

CVE-2025-46181 - Reflected XSS in an Online Appointment Booking System CVE-ID : CVE-2025-46181 Discovered by : Shemkumar P shemkumar.github.io Vulnerability Type : Reflected Cross-Site Scripting XSS Severity : Medium Status : Disclosed, CVE Assigned by MITRE ✨ Description A Reflected Cross-Site...

CVE-2025-22785

CVE-2025-22785 Course Booking System = 6.0.5 - Unauthenticated SQL Injection Description The Course Booking System plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 6.0.5 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2025-25965

CVE-2025-25965: Cross-Site Request Forgery CSRF in Online Banquet Booking System v1.2 Introduction Cross-Site Request Forgery CSRF remains one of the most overlooked yet dangerous vulnerabilities affecting web applications today. CVE-2025-25965 is a newly discovered CSRF vulnerability in the...

CVE-2026-116557

The WP Booking System - Booking Calendar plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpbsactionajaxcalendarremovenote function in versions up to, and including, 2.1.0.5 This makes it possible for authenticated attackers, with...

CVE-2026-116557

The WP Booking System - Booking Calendar plugin for WordPress is vulnerable to unauthorized data modification in versions up to and including 2.1.0.5 . The root cause is a missing capability check within the wpbs_action_ajax_calendar_remove_note() function. This flaw allows authenticated attacker...

CVE-2026-116557 WP Booking System <= 2.1.0.5 - Missing Authorization to Unauthenticated Arbitrary Calendar Note Deletion via wpbs_calendar_remove_note AJAX Action

The WP Booking System - Booking Calendar plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpbsactionajaxcalendarremovenote function in versions up to, and including, 2.1.0.5 This makes it possible for authenticated attackers, with...

EUVD-2026-114610

The WP Booking System - Booking Calendar plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpbsactionajaxcalendarremovenote function in versions up to, and including, 2.1.0.5 This makes it possible for authenticated attackers, with...

CVE-2024-57429

CVE-2024-57429 A cross-site request forgery CSRF vulnerability in the pjActionUpdate function of PHPJabbers Cinema Booking System v2.0 allows remote attackers to escalate privileges by tricking an authenticated admin into submitting an unauthorized request. Impact: Exploitation of this CSRF...

CVE-2026-116557: murgroland WP Booking System – Booking Calendar: The WP Booking System - Booking Calendar plugin for WordPress is vulnerable to unauthorized modification of data due to…

The WP Booking System - Booking Calendar plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpbsactionajaxcalendarremovenote function in versions up to, and including, 2.1.0.5 This makes it possible for authenticated attackers, with...

cve-disclosures

CVE Disclosures — Aman Bahiniya Three CVEs assigned by MITRE in December 2024. The records were reserved but never published, so nothing is indexed yet. This repo publishes the advisories so the CVEs become searchable and credited. CVE| Product| Type ---|---|--- CVE-2024-57551| Online Food Orderi...

WordPress WP Booking System – Booking Calendar plugin <= 2.1.0.5 - Missing Authorization to Unauthenticated Arbitrary Calendar Note Deletion vulnerability

Missing Authorization to Unauthenticated Arbitrary Calendar Note Deletion vulnerability discovered by mamgad mamgad in WordPress Plugin WP Booking System versions = 2.1.0.5...

PT-2026-134452

Name of the Vulnerable Software and Affected Versions WP Booking System - Booking Calendar plugin for WordPress versions prior to 2.1.0.6 Description An authorization flaw exists where a missing capability check in the wpbs action ajax calendar remove note function allows authenticated users with...

CVE-2025-7753

🚨 CVE-2025-7753 — SQL Injection PoC Exploit Author: Byte Reaper Telegram: @ByteReaper0 CVE: CVE‑2025‑7753 Vulnerability: Unauthenticated, time‑based SQL Injection 🔍 Overview A critical SQL Injection vulnerability exists in Online Appointment Booking System 1.0 Code‑Projects in the file...

Hashen Open Source Doctor Appointment Booking System using PHP, MySQL input validation error vulnerability

The Hashen Open Source Doctor Appointment Booking System using PHP and MySQL contains a security vulnerability. This vulnerability stems from improper handling of the ‘spec’ parameter in the admin/add-new.php file, potentially leading to SQL injection and allowing remote attacks...