2590 matches found
CVE-2025-22785
CVE-2025-22785 Course Booking System = 6.0.5 - Unauthenticated SQL Injection Description The Course Booking System plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 6.0.5 due to insufficient escaping on the user supplied parameter and lack of sufficient...
CVE-2025-46181-XSS
CVE-2025-46181 - Reflected XSS in an Online Appointment Booking System CVE-ID : CVE-2025-46181 Discovered by : Shemkumar P shemkumar.github.io Vulnerability Type : Reflected Cross-Site Scripting XSS Severity : Medium Status : Disclosed, CVE Assigned by MITRE ✨ Description A Reflected Cross-Site...
CVE-2026-107712
The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to time-based SQL Injection via the 'currentmonth' parameter in all versions up to, and including, 2.1.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...
CVE-2026-107712 WP Booking System <= 2.1.0.1 - Authenticated (Subscriber+) SQL Injection via 'current_month' Parameter
The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to time-based SQL Injection via the 'currentmonth' parameter in all versions up to, and including, 2.1.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...
CVE-2026-107712
The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to a time-based SQL Injection in all versions up to and including 2.1.0.1 . The root cause is insufficient escaping and a lack of sufficient preparation on the user-supplied 'current_month' parameter. This is a regression...
EUVD-2026-96215
The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to time-based SQL Injection via the 'currentmonth' parameter in all versions up to, and including, 2.1.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...
CVE-2026-103365 Online Scheduling and Appointment Booking System <= 28.4 - Unauthenticated Sensitive Information Exposure in 'phone' Parameter to bookly_render_details
The Bookly – Online Scheduling and Appointment Booking System plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 28.4 via the classic booking form's Details step. The endpoint booklyrenderdetails is registered for both wpajax and wpajaxnopriv, t...
EUVD-2026-96040
The Bookly – Online Scheduling and Appointment Booking System plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 28.4 via the classic booking form's Details step. The endpoint booklyrenderdetails is registered for both wpajax and wpajaxnopriv, t...
WordPress WP Booking System – Booking Calendar plugin <= 2.1.0.1 - Authenticated (Subscriber+) SQL Injection vulnerability
Authenticated Subscriber+ SQL Injection vulnerability discovered by Spy0x7 in WordPress Plugin WP Booking System versions = 2.1.0.1...
cve-disclosures
CVE Disclosures — Aman Bahiniya Three CVEs assigned by MITRE in December 2024. The records were reserved but never published, so nothing is indexed yet. This repo publishes the advisories so the CVEs become searchable and credited. CVE| Product| Type ---|---|--- CVE-2024-57551| Online Food Orderi...
CVE-2026-94668
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Reflected XSS.This issue affects Salon booking system: from n/a through 10.31.5...
CVE-2026-94668
The Dimitri Grassi Salon booking system WordPress plugin is vulnerable to Reflected Cross-Site Scripting (XSS) in versions 10.31.5 and earlier . The root cause is the Improper Neutralization of Input During Web Page Generation (CWE-79). This vulnerability allows an attacker to execute arbitrary s...
CVE-2026-94668 WordPress Salon booking system plugin <= 10.31.5 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Reflected XSS.This issue affects Salon booking system: from n/a through 10.31.5...
EUVD-2026-95622
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Reflected XSS.This issue affects Salon booking system: from n/a through 10.31.5...
PT-2026-108837
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Reflected XSS.This issue affects Salon booking system: from n/a through 10.31.5...
CVE-2025-7753
🚨 CVE-2025-7753 — SQL Injection PoC Exploit Author: Byte Reaper Telegram: @ByteReaper0 CVE: CVE‑2025‑7753 Vulnerability: Unauthenticated, time‑based SQL Injection 🔍 Overview A critical SQL Injection vulnerability exists in Online Appointment Booking System 1.0 Code‑Projects in the file...
CVE-2026-105070
Unauthenticated Privilege Escalation in Salon booking system = 10.31.7 versions...
CVE-2026-105070 WordPress Salon booking system plugin <= 10.31.7 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in Salon booking system = 10.31.7 versions...