Service Finder Bookings - Authentication Bypass

Service Finder Bookings WordPress plugin = 6.0 contains a privilege escalation caused by improper validation of user cookie in servicefinderswitchback function, letting unauthenticated attackers login as any user including admins. id: CVE-2025-5947 info: name: Service Finder Bookings -...

CVE-2026-110012 Salon Booking System < 10.31.3 - Subscriber+ Booking PII Disclosure via REST bookings/upcoming

The Salon Booking System WordPress plugin before 10.31.3 does not restrict several of its booking REST API routes to users with the appropriate capability, allowing any authenticated user such as a subscriber to read every customer's booking records, including their personal data...

CVE-2026-110012

The Salon Booking System WordPress plugin, in versions before 10.31.3 , contains a vulnerability where several booking REST API routes lack proper capability restrictions. This flaw allows any authenticated user, such as a subscriber , to access and read every customer's booking records, leading ...

CVE-2025-5947

CVE-2025-5947 CVE-2025-5947 WordPress Service Finder Bookings ≤ 6.0 Exploit CVE-2025-5947 Exploit - Service Finder Bookings Exploit tool for authentication bypass vulnerability in WordPress Service Finder Bookings ≤ 6.0 plugin 📋 Table of Contents About the Vulnerability Technical Details...

CVE-2026-14854

The WooCommerce Bookings WordPress plugin before 3.11.0 does not limit a user-supplied value before using it to allocate memory in one of its unauthenticated AJAX actions, allowing unauthenticated attackers to exhaust server memory and cause a Denial of Service with a single request...

EUVD-2026-96746

The WooCommerce Bookings WordPress plugin before 3.11.0 does not limit a user-supplied value before using it to allocate memory in one of its unauthenticated AJAX actions, allowing unauthenticated attackers to exhaust server memory and cause a Denial of Service with a single request...

CVE-2026-14854 WooCommerce Bookings < 3.11.0 - Unauthenticated Denial of Service

The WooCommerce Bookings WordPress plugin before 3.11.0 does not limit a user-supplied value before using it to allocate memory in one of its unauthenticated AJAX actions, allowing unauthenticated attackers to exhaust server memory and cause a Denial of Service with a single request...

CVE-2026-14854

The WooCommerce Bookings WordPress plugin, in versions prior to 3.11.0 , is vulnerable to an unauthenticated Denial of Service (DoS) . The flaw exists because the plugin fails to limit a user-supplied value used for memory allocation within an unauthenticated AJAX action . An unauthenticated atta...

CVE-2026-14854: Uncontrolled Resource Consumption

The WooCommerce Bookings WordPress plugin before 3.11.0 does not limit a user-supplied value before using it to allocate memory in one of its unauthenticated AJAX actions, allowing unauthenticated attackers to exhaust server memory and cause a Denial of Service with a single request...

EUVD-2026-95398

Authorization bypass through user-controlled key in Microsoft Bookings allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-94510

Authorization bypass through user-controlled key in Microsoft Bookings allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-94510

A vulnerability in Microsoft Bookings allows an unauthorized attacker to achieve elevation of privilege over a network. The root cause is an authorization bypass occurring through a user-controlled key . The impact is classified as CRITICAL , with a CVSS 3.1 base score of 9.9 , specifically affec...

Microsoft Bookings Elevation of Privilege Vulnerability

Authorization bypass through user-controlled key in Microsoft Bookings allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-94510: Authorization Bypass Through User-Controlled Key

Authorization bypass through user-controlled key in Microsoft Bookings allows an unauthorized attacker to elevate privileges over a network...

KLA91324 PE vulnerability in Microsoft Apps

Privilege escalation vulnerability was found in Microsoft Apps. Malicious users can exploit this vulnerability to gain privileges. Original advisories CVE-2026-94510 Exploitation CVE list CVE-2026-94510 unknown Solution Install necessary updates from the KB section, that are listed in your Window...

PT-2026-108301

Name of the Vulnerable Software and Affected Versions Microsoft Bookings affected versions not specified Description An authorization bypass exists due to a user-controlled key, which allows an unauthorized attacker to elevate privileges over a network. Recommendations At the moment, there is no...

CVE-2026-87840 Tripzzy < 1.5.1 - Unauthenticated Booking Data Tampering

The Tripzzy WordPress plugin before 1.5.1 does not perform any capability or ownership checks on its administrative booking-management actions, which are additionally exposed to unauthenticated users and gated only by a token the Tripzzy WordPress plugin before 1.5.1 issues to any anonymous visit...

EUVD-2026-83673

The Tripzzy WordPress plugin before 1.5.1 does not perform any capability or ownership checks on its administrative booking-management actions, which are additionally exposed to unauthenticated users and gated only by a token the Tripzzy WordPress plugin before 1.5.1 issues to any anonymous visit...

CVE-2026-87840

The Tripzzy WordPress plugin (versions before 1.5.1 ) contains an improper access control vulnerability allowing unauthenticated booking data tampering. The plugin fails to perform necessary capability or ownership checks on administrative booking-management actions. These actions are exposed to ...

CVE-2026-87840: Improper Access Control

The Tripzzy WordPress plugin before 1.5.1 does not perform any capability or ownership checks on its administrative booking-management actions, which are additionally exposed to unauthenticated users and gated only by a token the Tripzzy WordPress plugin before 1.5.1 issues to any anonymous visit...