WordPress Pinpoint Booking System – Version 2 plugin <= 2.9.9.6.9 - Authenticated (Administrator+) SQL Injection vulnerability

Authenticated Administrator+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin Pinpoint Booking System versions = 2.9.9.6.9...

SUSE CVE-2026-57948

Pinpoint through version 3.1.0 contains an insecure session management vulnerability that allows attackers to access the pinpointJwt session cookie due to missing HttpOnly and Secure attributes, enabling JavaScript access via document.cookie and cleartext transmission over HTTP. Attackers can...

com.navercorp.pinpoint:pinpoint-batch (>=2.3.0, <=3.1.0), com.navercorp.pinpoint:pinpoint-flink (>=2.3.0, <=3.0.5) +6 more potentially affected by CVE-2026-57948 via com.navercorp.pinpoint:pinpoint-web (>=2.3.0, <=3.1.0)

com.navercorp.pinpoint:pinpoint-web MAVEN version =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =3.0.0, =3.0.0, =2.5.0, =3.1.0 Source cves: CVE-2026-57948 Source advisory: SNYK:JAVA-COMNAVERCORPPINPOINT-17755931...

com.navercorp.pinpoint:pinpoint-batch (3.1.0), com.navercorp.pinpoint:pinpoint-hbase2-web (>=2.5.1-p1, <=2.5.4) +3 more potentially affected by CVE-2026-57948 via com.navercorp.pinpoint:pinpoint-basic-login (>=2.5.1, <=3.1.0)

com.navercorp.pinpoint:pinpoint-basic-login MAVEN version =2.5.1, =2.5.1-p1, =3.0.0, =2.5.1, =2.5.1, =3.1.0 Source cves: CVE-2026-57948 Source advisory: SNYK:JAVA-COMNAVERCORPPINPOINT-17755930...

com.navercorp.pinpoint:pinpoint-batch (>=3.0.0, <=3.1.0), com.navercorp.pinpoint:pinpoint-log-web (>=3.0.0, <=3.1.0) +4 more potentially affected by CVE-2026-57947 via com.navercorp.pinpoint:pinpoint-batch-alarmsender (>=3.0.0, <=3.1.0)

com.navercorp.pinpoint:pinpoint-batch-alarmsender MAVEN version =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.1.0 Source cves: CVE-2026-57947 Source advisory: SNYK:JAVA-COMNAVERCORPPINPOINT-17755928...

com.navercorp.pinpoint:pinpoint-batch (>=3.0.0, <=3.1.0), com.navercorp.pinpoint:pinpoint-batch-alarmsender (>=3.0.0, <=3.1.0) +5 more potentially affected by CVE-2026-57947 via com.navercorp.pinpoint:pinpoint-webhook (>=3.0.0, <=3.1.0)

com.navercorp.pinpoint:pinpoint-webhook MAVEN version =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.1.0 Source cves: CVE-2026-57947 Source advisory: SNYK:JAVA-COMNAVERCORPPINPOINT-17755929...

EUVD-2026-40165

Pinpoint through version 3.1.0 contains an insecure session management vulnerability that allows attackers to access the pinpointJwt session cookie due to missing HttpOnly and Secure attributes, enabling JavaScript access via document.cookie and cleartext transmission over HTTP. Attackers can...

CVE-2026-57948 Pinpoint - Insecure Session Cookie Attributes in pinpointJwt

Pinpoint through version 3.1.0 contains an insecure session management vulnerability that allows attackers to access the pinpointJwt session cookie due to missing HttpOnly and Secure attributes, enabling JavaScript access via document.cookie and cleartext transmission over HTTP. Attackers can...

CVE-2026-57948 Pinpoint - Insecure Session Cookie Attributes in pinpointJwt

Pinpoint through version 3.1.0 contains an insecure session management vulnerability that allows attackers to access the pinpointJwt session cookie due to missing HttpOnly and Secure attributes, enabling JavaScript access via document.cookie and cleartext transmission over HTTP. Attackers can...

CVE-2026-57948

Pinpoint (through version 3.1.0) has an insecure session management vulnerability where the pinpointJwt cookie lacks HttpOnly and Secure attributes. This allows JavaScript access via document.cookie and cleartext transmission over HTTP, enabling potential exfiltration of the session token via sto...

CVE-2026-57947

Pinpoint (through 3.1.0) has a server-side request forgery in the webhook registration endpoint. Authenticated users can register internal URLs due to missing SSRF protection, potentially causing the server to issue POST requests to internal hosts and metadata endpoints, enabling unauthorized acc...

CVE-2026-57947 Pinpoint - Server-Side Request Forgery via Alarm Webhook Registration

Pinpoint through 3.1.0 contains a server-side request forgery vulnerability in the webhook registration endpoint that allows authenticated users to register internal URLs due to missing SSRF protection. Attackers can trigger alarm threshold breaches to force the server to issue POST requests to...

CVE-2026-57947

Pinpoint through 3.1.0 contains a server-side request forgery vulnerability in the webhook registration endpoint that allows authenticated users to register internal URLs due to missing SSRF protection. Attackers can trigger alarm threshold breaches to force the server to issue POST requests to...

CVE-2026-57947 Pinpoint - Server-Side Request Forgery via Alarm Webhook Registration

Pinpoint through 3.1.0 contains a server-side request forgery vulnerability in the webhook registration endpoint that allows authenticated users to register internal URLs due to missing SSRF protection. Attackers can trigger alarm threshold breaches to force the server to issue POST requests to...

PT-2026-53666

Name of the Vulnerable Software and Affected Versions Pinpoint versions prior to 3.1.1 Description Insecure session management occurs because the pinpointJwt session cookie lacks HttpOnly and Secure attributes. This allows the cookie to be accessed via JavaScript through document.cookie and...

CVE-2026-57948: Sensitive Cookie Without 'HttpOnly' Flag

Pinpoint through version 3.1.0 contains an insecure session management vulnerability that allows attackers to access the pinpointJwt session cookie due to missing HttpOnly and Secure attributes, enabling JavaScript access via document.cookie and cleartext transmission over HTTP. Attackers can...

Application of LLMs to Threat Assessment of Foreign Peacekeeping Missions

We present a novel approach for applying Large Language Models LLMs to threat assessment in the context of foreign peacekeeping missions. Building on the PINPOINT project and its use case, the EU Monitoring Mission in Georgia, we combine an interdisciplinary risk-model with OSINT-based media...

CVE-2026-39678

Missing Authorization vulnerability in DOTonPAPER Pinpoint Booking System booking-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pinpoint Booking System: from n/a through = 2.9.9.6.5...

EUVD-2026-20359

Missing Authorization vulnerability in DOTonPAPER Pinpoint Booking System booking-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pinpoint Booking System: from n/a through = 2.9.9.6.5...

CVE-2026-39678

Missing Authorization vulnerability in Pinpoint Booking System Pinpoint Booking System booking-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pinpoint Booking System: from n/a through 2.9.9.7.2...