CVE-2025-7526: Improper Limitation of a Pathname to a Restricted Directory

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to arbitrary file deletion via renaming due to insufficient file path validation in the setuserprofileimage function in all versions up to, and including, 6.6.7. This makes it possible for...

EUVD-2019-6698

Malware in sbrugna...

EUVD-2020-17047

Malware in sbrugna...

EUVD-2024-21012

Malicious code in bioql PyPI...

EUVD-2025-22981

Malicious code in bioql PyPI...

EUVD-2025-6403

Malicious code in bioql PyPI...

EUVD-2025-3526

Malicious code in bioql PyPI...

EUVD-2024-50875

Malicious code in bioql PyPI...

EUVD-2024-48706

Malicious code in bioql PyPI...

EUVD-2024-49171

Malicious code in bioql PyPI...

EUVD-2024-48090

Malicious code in bioql PyPI...

EUVD-2025-24787

Malicious code in bioql PyPI...

EUVD-2025-24788

Malicious code in bioql PyPI...

EUVD-2022-33781

Malicious code in bioql PyPI...

EUVD-2024-45690

Malicious code in bioql PyPI...

CVE-2025-6941: Improper Neutralization of Input During Web Page Generation

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the 'latepointresources' shortcode in all versions up to, and including, 5.1.94 due to insufficient input sanitization and output escapin...

CVE-2025-6815: Improper Neutralization of Input During Web Page Generation

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘servicename’ parameter in all versions up to, and including, 5.1.94 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2025-58661

Technical details not publicly provided in the supplied documents for CVE-2025-58661 (eZee Online Hotel Booking Engine). Update with affected versions, impact, and remediation when available.

CVE-2025-8942 WP Hotel Booking < 2.2.3 - Subscriber+ Rating Manipulation

The WP Hotel Booking WordPress plugin before 2.2.3 lacks proper server-side validation for review ratings, allowing an attacker to manipulate the rating value e.g., sending negative or out-of-range values by intercepting and modifying requests...

WordPress FAT Event - WordPress Event and Calendar Booking plugin <= 5.15 - Local File Inclusion vulnerability

WordPress FAT Event - WordPress Event and Calendar Booking plugin = 5.15 - Local File Inclusion vulnerability discovered by Jingle Bells in WordPress Plugin FAT Event - WordPress Event and Calendar Booking versions = 5.15...