PT-2026-91112

A vulnerability has been found in SourceCodester Inventory Management System 1.0. Affected is an unknown function of the file /api/customers handler.php of the component Customer Management Module. Such manipulation of the argument Customer Name leads to cross site scripting. The attack can be...

CVE-2026-90694: Improper Neutralization of Input During Web Page Generation

A vulnerability has been found in SourceCodester Inventory Management System 1.0. Affected is an unknown function of the file /api/customershandler.php of the component Customer Management Module. Such manipulation of the argument CustomerName leads to cross site scripting. The attack can be...

CVE-2026-88995

The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.1 does not properly restrict the data returned by an availability-check request, allowing unauthenticated users to retrieve other customers' appointment details, including free-text booking comments and contact information...

WordPress Rox Appointment Booking plugin 1.0.9-1.2.2 - Unauthenticated Customer PII Disclosure vulnerability

Unauthenticated Customer PII Disclosure vulnerability discovered by Farid Narimanov in WordPress Plugin Rox Appointment Booking Appointment Booking Scheduling Solution versions 1.0.9-1.2.2...

CVE-2026-77705 Amelia < 2.4.10 - Amelia Manager+ WordPress Account Takeover

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.10 does not verify that the user editing a customer or employee record is entitled to modify the WordPress account linked to it, allowing users holding Amelia's customer or employee management permissions to set the...

CVE-2026-77705 Amelia < 2.4.10 - Amelia Manager+ WordPress Account Takeover

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.10 does not verify that the user editing a customer or employee record is entitled to modify the WordPress account linked to it, allowing users holding Amelia's customer or employee management permissions to set the...

CVE-2026-77705

The Booking for Appointments and Events Calendar WordPress plugin (Amelia), in versions before 2.4.10 , is vulnerable to an account takeover flaw. The plugin fails to verify if a user editing a customer or employee record has the authorization to modify the linked WordPress account . Consequently...

PT-2026-90560

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.10 does not verify that the user editing a customer or employee record is entitled to modify the WordPress account linked to it, allowing users holding Amelia's customer or employee management permissions to set the...

CVE-2026-11446 Booktics – Booking Calendar for Appointments and Service Businesses <= 1.0.23 - Missing Authorization

The Booktics – Booking Calendar for Appointments and Service Businesses plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 1.0.23. This is due to the createorderpermission permission callback on the POST /wp-json/booktics/v1/orders REST...

PT-2026-89745

The Booktics – Booking Calendar for Appointments and Service Businesses plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 1.0.23. This is due to the create order permission permission callback on the POST /wp-json/booktics/v1/orders REST...

CVE-2026-68487

Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated customer...

CVE-2026-68487

Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated customer...

CVE-2026-68487

CVE-2026-68487 is a path traversal vulnerability in Plesk's Backup Manager caused by an unsigned backup header , allowing an authenticated customer to perform an arbitrary file write as root . The vulnerability is scored CVSS 9.9 (Critical) with a changed scope, reflecting high impact on confiden...

CVE-2026-19439 Ultimate Gift Cards for WooCommerce 3.0.3 - 3.2.9 - Unauthenticated Gift Card Code and Customer PII Disclosure via wps_uwgc_report_details

The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not have any authorisation check when displaying gift card details, allowing unauthenticated users to retrieve the gift cards attached to arbitrary orders and disclose customer personal data, balances, dates and, in 3.2.9...

CVE-2026-81021 SupportCandy 3.2.9 - 3.5.2 - Unauthenticated Ticket Attachment Disclosure

The SupportCandy WordPress plugin before 3.5.3 does not perform an authorization check on one of its support-ticket attachment download paths, allowing unauthenticated attackers to read protected customer-uploaded attachments by enumerating sequential attachment identifiers...

CVE-2026-80340 Payment Plugins for PayPal WooCommerce < 2.0.26 - Unauthenticated Customer PII Disclosure via order-pay

The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not validate the order key before adding order data to the JavaScript configuration it outputs on the front end, allowing unauthenticated users to obtain the secret that gates access to any order and, through it, that...

WordPress Payment Plugins for PayPal WooCommerce plugin < 2.0.26 - Unauthenticated Customer PII Disclosure vulnerability

Unauthenticated Customer PII Disclosure vulnerability discovered by Erwan LR WPScan in WordPress Plugin Payment Plugins for PayPal WooCommerce versions 2.0.26...

CVE-2026-7861

Deserialization of untrusted data vulnerability in Next4Biz Information Technologies Inc. CSM Customer Service Management allows Code Injection. This issue affects CSM Customer Service Management: before 8.0.3...

CVE-2026-6377

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Next4Biz Information Technologies Inc. CSM Customer Service Management allows Path Traversal. This issue affects CSM Customer Service Management: from 6.8.9 before 8.0.3...

CVE-2026-7861 Code Injection in Next4Biz's CSM (Customer Service Management)

Deserialization of untrusted data vulnerability in Next4Biz Information Technologies Inc. CSM Customer Service Management allows Code Injection. This issue affects CSM Customer Service Management: through 07092026. NOTE: The vendor is continuing efforts to remediate the vulnerability...