7823 matches found
PT-2026-72139
Name of the Vulnerable Software and Affected Versions Pinpoint Booking System – Version 2 versions prior to 2.9.9.6.9 Description Unauthenticated attackers can manipulate the checkout price of bookable products tied to a booking calendar. The issue occurs because the dopbsp woocommerce add to car...
PT-2026-72152
Name of the Vulnerable Software and Affected Versions Hydra Booking — Appointment Scheduling & Booking Calendar versions prior to 1.2.3 Description Stored Cross-Site Scripting XSS occurs due to insufficient input sanitization and output escaping. This allows attackers to inject arbitrary web...
PT-2026-72149
Name of the Vulnerable Software and Affected Versions Booking calendar, Appointment Booking System versions prior to 3.2.37 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Unauthenticated attackers can wri...
CVE-2025-10308
The Astro Booking Engine plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.0. This is due to missing nonce validation on the options deletion functionality. This makes it possible for unauthenticated attackers to delete all plugin settings...
CVE-2025-10308
The Astro Booking Engine WordPress plugin is affected by a CSRF (Cross-Site Request Forgery) vulnerability in all versions up to 1.4.0, caused by missing nonce validation on the options deletion function. This allows unauthenticated attackers to delete all plugin settings by tricking a site admin...
EUVD-2025-210726
The Astro Booking Engine plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.0. This is due to missing nonce validation on the options deletion functionality. This makes it possible for unauthenticated attackers to delete all plugin settings...
CVE-2025-10308 Astro Booking Engine <= 1.4.0 - Cross-Site Request Forgery to Settings Reset
The Astro Booking Engine plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.0. This is due to missing nonce validation on the options deletion functionality. This makes it possible for unauthenticated attackers to delete all plugin settings...
CVE-2026-46382
A flaw was found in the Meeting Room Booking System MRBS. This vulnerability, known as Server-Side Request Forgery SSRF, allows a remote attacker to trick the server into making requests to internal or local network resources. By exploiting this, an attacker could potentially gain unauthorized...
CVE-2026-66453
Unauthenticated Broken Authentication in Salon booking system = 10.30.26 versions...
CVE-2026-61962
Unauthenticated Arbitrary Code Execution in WP BASE Booking = 6.3.0 versions...
CVE-2026-28188
Unauthenticated Broken Access Control in Hydra Booking = 1.2.2 versions...
CVE-2026-28176
Unauthenticated PHP Object Injection in Booking Activities = 1.18.4 versions...
CVE-2026-28159
Subscriber Broken Access Control in Service Finder Booking = 6.2 versions...
CVE-2026-28161
Subscriber Privilege Escalation in Service Finder Booking = 6.2 versions...
CVE-2026-27345
Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce = 2.0.3 versions...
EUVD-2026-57873
Unauthenticated Broken Authentication in Salon booking system = 10.30.26 versions...
CVE-2026-66453
Unauthenticated Broken Authentication in Salon booking system = 10.30.26 versions...
CVE-2026-66453 WordPress Salon booking system plugin <= 10.30.26 - Broken Authentication vulnerability
Unauthenticated Broken Authentication in Salon booking system = 10.30.26 versions...