73042 matches found
CVE-2026-14305
The WP Delicious WordPress plugin before 1.10.2 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to modify limited post metadata a like counter and an associated identifier list on arbitrary posts, including inflating the counter and growing the...
CVE-2026-14223
The Easy Appointments WordPress plugin before 3.12.28 does not verify ownership or capability when returning stored customer details, allowing users with subscriber-level access to read any customer's personal information by iterating an identifier...
CVE-2026-13145
The WP Travel WordPress plugin before 11.8.1 does not verify that the booking requested on its customer account dashboard belongs to the current user, allowing any logged-in user to read another customer's booking details, including billing address information, by supplying an arbitrary booking...
EUVD-2026-51015
The WP Delicious WordPress plugin before 1.10.2 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to modify limited post metadata a like counter and an associated identifier list on arbitrary posts, including inflating the counter and growing the...
CVE-2026-13395 Bookly < 27.8 - Unauthenticated SQL Injection via staff_id
The Online Scheduling and Appointment Booking System WordPress plugin before 27.8 does not sanitize or properly cast a user-supplied parameter from its unauthenticated front-end booking requests before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks an...
CVE-2026-13145
The CVE covers WP Travel for WordPress, pre-11.8.1. Affected: WP Travel WordPress plugin before 11.8.1. Issue: reading another user’s booking details (including billing address) via an IDOR on the customer account dashboard because the plugin does not verify that the requested booking belongs to ...
EUVD-2026-51008
The WP Travel WordPress plugin before 11.8.1 does not verify that the booking requested on its customer account dashboard belongs to the current user, allowing any logged-in user to read another customer's booking details, including billing address information, by supplying an arbitrary booking...
EUVD-2026-50984
The Easy Appointments WordPress plugin through 3.12.26 does not verify ownership or capability when returning stored customer details, allowing users with subscriber-level access to read any customer's personal information by iterating an identifier...
CVE-2026-14223 Easy Appointments < 3.12.28 - Subscriber+ Customer PII Disclosure via IDOR
The Easy Appointments WordPress plugin before 3.12.28 does not verify ownership or capability when returning stored customer details, allowing users with subscriber-level access to read any customer's personal information by iterating an identifier...
CVE-2026-16531
An unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy logger servlet using a crafted hostname. This allows arbitrary file and directory creation, potentially leading to a denial of service...
CVE-2026-17898
creationtimestamp| type| source ---|---|--- 2026-07-30 05:19:25+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260730 2026-08-03 10:54:41+00:00| seen| https://www.hkcert.org/security-bulletin/microsoft-edge-multiple-vulnerabilities20260803...
CVE-2026-17717
creationtimestamp| type| source ---|---|--- 2026-07-30 04:50:12+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260730 2026-07-30 19:56:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrv7v6gan42u 2026-08-03 09:40:20+00:00| seen|...
CVE-2026-17748
creationtimestamp| type| source ---|---|--- 2026-07-30 04:49:41+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260730 2026-08-03 09:47:20+00:00| seen| https://www.hkcert.org/security-bulletin/microsoft-edge-multiple-vulnerabilities20260803...
CVE-2026-17691
creationtimestamp| type| source ---|---|--- 2026-07-30 04:47:22+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260730 2026-07-30 16:36:09+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mruupk4vwc2i 2026-08-03 09:31:35+00:00| seen|...
CVE-2025-71387
creationtimestamp| type| source ---|---|--- 2026-07-30 04:45:03+00:00| seen| https://jvn.jp/en/vu/JVNVU98815601 2026-08-30 13:33:24+00:00| seen| https://bsky.app/profile/getpokemon7.bsky.social/post/3mucixhfot22o...
GHSA-XGR6-PQJV-3PF8
creationtimestamp| type| source ---|---|--- 2026-07-30 04:31:31+00:00| seen| https://gist.github.com/alon710/2d94cc50795411681f41b69ad6e69380...
CVE-2026-67244
creationtimestamp| type| source ---|---|--- 2026-07-30 04:16:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/34ezh5ocufffj 2026-08-04 14:29:14+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3msb7xdfg3x2c 2026-08-05 19:37:07+00:00| seen|...
CVE-2026-48448
creationtimestamp| type| source ---|---|--- 2026-07-30 04:00:22+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrtki7wira23 2026-08-01 11:00:24+00:00| seen| https://bsky.app/profile/hendryadrian.bsky.social/post/3mrzcv5vr7s2e 2026-08-04 11:12:11+00:00| seen|...
CVE-2026-48449
creationtimestamp| type| source ---|---|--- 2026-07-30 03:52:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrtjzfcgkl2e 2026-07-30 04:00:29+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrtkiggdyr2u 2026-07-30 14:04:22+00:00| seen|...