93145 matches found
CVE-2026-92421
The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.3 does not verify that the host record being modified belongs to the user making the request, allowing authenticated users holding a Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin...
Malicious code in urc (PyPI)
Source: kam193 abbaafd909f0cd09835c29c401432a9aa6094c2007973ba23e70f3fe06b07785 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...
CVE-2026-92420 Hydra Booking < 1.2.2 - Hydra Host+ Cross-Host Booking Deletion and Modification via IDOR
The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.2 does not verify that a booking belongs to the requesting user before modifying or deleting it on two of its booking endpoints, allowing a booking-provider-level user to cancel and permanently delete other...
WordPress Hydra Booking — Appointment Scheduling & Booking Calendar plugin 1.1.0-1.2.2 - Hydra Host+ Host Profile Takeover vulnerability
Hydra Host+ Host Profile Takeover vulnerability discovered by Ossacip Thanh in WordPress Plugin Hydra Booking versions 1.1.0-1.2.2...
EUVD-2026-83515
The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.4 does not perform object-level authorisation checks on several of its host-management operations, allowing users who hold its own administrator-assigned custom role to read, modify and permanently delete...
CVE-2026-92425 Hydra Booking < 1.2.4 - Hydra Host+ Cross-Host Account Modification and Deletion via IDOR
The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.4 does not perform object-level authorisation checks on several of its host-management operations, allowing users who hold its own administrator-assigned custom role to read, modify and permanently delete...
CVE-2026-92420
The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin (versions before 1.2.2 ) is vulnerable to an Insecure Direct Object Reference (IDOR) . The application fails to verify that a booking belongs to the requesting user when performing actions on two specific booking endpo...
EUVD-2026-83514
The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.3 does not verify that the host record being modified belongs to the user making the request, allowing authenticated users holding a Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin...
CVE-2026-92421
The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin (versions before 1.2.3 ) is vulnerable to an Insecure Direct Object Reference (IDOR) . The application fails to verify if a host record belongs to the user making the request. This allows authenticated users with an as...
WordPress Hydra Booking — Appointment Scheduling & Booking Calendar plugin < 1.2.2 - Hydra Host+ Cross-Host Booking Deletion and Modification vulnerability
Hydra Host+ Cross-Host Booking Deletion and Modification vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Hydra Booking versions 1.2.2...
CVE-2026-92425
The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin (versions before 1.2.4 ) is vulnerable to an Insecure Direct Object Reference (IDOR) . The software fails to perform object-level authorisation checks on several host-management operations. This allows users with an ad...
CVE-2026-92421 Hydra Booking 1.1.0 - < 1.2.3 - Hydra Host+ Host Profile Takeover via IDOR
The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.3 does not verify that the host record being modified belongs to the user making the request, allowing authenticated users holding a Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin...
CVE-2026-92425 Hydra Booking < 1.2.4 - Hydra Host+ Cross-Host Account Modification and Deletion via IDOR
The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.4 does not perform object-level authorisation checks on several of its host-management operations, allowing users who hold its own administrator-assigned custom role to read, modify and permanently delete...
WordPress Hydra Booking — Appointment Scheduling & Booking Calendar plugin < 1.2.4 - Hydra Host+ Cross-Host Account Modification and Deletion vulnerability
Hydra Host+ Cross-Host Account Modification and Deletion vulnerability discovered by Stefan Spasic in WordPress Plugin Hydra Booking versions 1.2.4...
CVE-2026-92421 Hydra Booking 1.1.0 - < 1.2.3 - Hydra Host+ Host Profile Takeover via IDOR
The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.3 does not verify that the host record being modified belongs to the user making the request, allowing authenticated users holding a Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin...
CLEANSTART-2026-BI76968 privileged Vault operator within the root namespace with write permission to {{sys/audit}} may obtain code execution on the underlying host if a plugin directory is set in Vault’s configuration
Security vulnerability affects the vault package. A privileged Vault operator within the root namespace with write permission to sys/audit may obtain code execution on the underlying host if a plugin directory is set in Vault’s configuration...
CVE-2026-15463: Improper Neutralization of Input During Web Page Generation
The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'host' parameter in all versions up to, and including, 4.7.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticat...
CVE-2026-92425: Authorization Bypass Through User-Controlled Key
The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.4 does not perform object-level authorisation checks on several of its host-management operations, allowing users who hold its own administrator-assigned custom role to read, modify and permanently delete...
CVE-2026-92421: Authorization Bypass Through User-Controlled Key
The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.3 does not verify that the host record being modified belongs to the user making the request, allowing authenticated users holding a Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin...