WordPress Booking for Appointments and Events Calendar plugin < 2.4.9 - Unauthenticated Post-Booking Action Trigger vulnerability

Unauthenticated Post-Booking Action Trigger vulnerability discovered by Haitam Lazaar in WordPress Plugin Amelia versions 2.4.9...

CVE-2026-14215

The Booking for Appointments and Events Calendar WordPress plugin (Amelia) versions before 2.4.9 is vulnerable to an unauthenticated post-booking action trigger. The root cause is a lack of authentication or valid request token verification before executing the post-booking action chain . An unau...

EUVD-2026-69869

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not require authentication or a valid request token before running the post-booking action chain, allowing an unauthenticated user to trigger booking notifications and integration callbacks for a booking by...

CVE-2026-14215 Amelia < 2.4.9 - Unauthenticated Post-Booking Action Trigger

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not require authentication or a valid request token before running the post-booking action chain, allowing an unauthenticated user to trigger booking notifications and integration callbacks for a booking by...

CVE-2026-14215 Amelia < 2.4.9 - Unauthenticated Post-Booking Action Trigger

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not require authentication or a valid request token before running the post-booking action chain, allowing an unauthenticated user to trigger booking notifications and integration callbacks for a booking by...

CVE-2026-84484

creationtimestamp| type| source ---|---|--- 2026-09-02 03:02:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/epaydyhordnwe 2026-09-02 05:01:30+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3muj5qtlzon27 2026-09-02 05:01:31+00:00| seen|...

CVE-2026-84485

creationtimestamp| type| source ---|---|--- 2026-09-02 03:00:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/bebidaz3dknh4 2026-09-02 08:01:01+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mujhrsnoe62q...

CVE-2026-84715

creationtimestamp| type| source ---|---|--- 2026-09-02 02:54:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/fykkc3x3o3xls 2026-09-02 08:01:08+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mujhrzlupg2q 2026-09-02 14:00:06+00:00| seen|...

CVE-2026-80047

creationtimestamp| type| source ---|---|--- 2026-09-02 02:49:01+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3muiwdwyln52l 2026-09-02 07:30:52+00:00| seen| https://bsky.app/profile/newsfacts.bsky.social/post/3mujg3vvro22j...

CVE-2026-84696

creationtimestamp| type| source ---|---|--- 2026-09-02 02:07:51+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3muiu2dxz5j2b 2026-09-02 13:50:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3muk3c2gkkj22...

CVE-2026-84427

creationtimestamp| type| source ---|---|--- 2026-09-02 01:37:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/7aprxbp36hk3j...

EUVD-2026-69707

Post-authentication Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability has been identified in the SMA1000 Appliance Management Console AMC which in specific conditions could potentially enable a remote authenticated attacker as administrator to...

CVE-2026-84806: Incorrect Permission Assignment for Critical Resource

Kimai before 2.63.0 contains an improper authorization vulnerability in team access endpoints that allows authenticated users with team edit permissions and read-only access to grant team access to customers, projects, or activities. Attackers can exploit insufficient permission checks by sending...

CVE-2026-52832: Improper Limitation of a Pathname to a Restricted Directory

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio Dashboard exposes POST /api/functions without authentication by default NOP auth mode. The spec.handler field e.g., mymodule:myfunction is parsed by functionconfig.ParseHandler which split...

PT-2026-84613

The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not escape the post title before outputting it in an inline JavaScript event handler, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks which are triggered when...

The vulnerability of the Vesta Control Panel server’s control panel allows a hacker to execute arbitrary commands.

The vulnerability of the Vesta Control Panel’s control panel lies in the lack of measures taken to clean data at the management level. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands through the vsftplicense parameter when sending HTTP POST requests to the...

CVE-2026-17563: Missing Authorization

The User Frontend WordPress plugin before 4.3.11 does not enforce its subscription-purchase requirement when processing frontend post submissions, only when rendering the form, allowing unauthenticated users to create and, depending on the form's configuration, immediately publish posts through...

CVE-2026-14215: Missing Authorization

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not require authentication or a valid request token before running the post-booking action chain, allowing an unauthenticated user to trigger booking notifications and integration callbacks for a booking by...

CVE-2026-84807: Incorrect Privilege Assignment

Kimai kimai/kimai through 2.65.0 contains a business logic / improper authorization vulnerability in the default team creation endpoints. An authenticated user with project permission-management privileges can create or use a customer, project, or activity whose name matches an existing team;...

CVE-2026-77124: Incomplete List of Disallowed Inputs

In affected versions of Nexus Repository 3, the script execution endpoint POST /service/rest/v1/script/name/run did not verify whether script execution had been administratively disabled. An account holding script-execution permission could continue to run previously-created scripts even after an...