25 matches found
CVE-2026-3576
CVE-2026-3576 - WordPressプラグイン Planyo Online Reservation System -f --disable-check python exploit.py http://127.0.0.1/wordpress/ -f /etc/passwd 実行例 └─$ python exploit.py http://127.0.0.1/wordpress/ -f /etc/passwd Checking if target is vulnerable... + Version found: 2.9 + Target is vulnerable...
Planyo Online Reservation System <= 3.0 - Arbitrary File Read
The Planyo Online Reservation System plugin for WordPress through 3.0 ships ulap.php, an AJAX proxy that is directly reachable without WordPress bootstrapping or authentication. The sendhttppost function validates the host of the supplied URL against an allowlist that includes localhost, but neve...
Planyo Online Reservation System 3.0 SSRF / Arbitrary File Read
Planyo Online Reservation System versions 3.0 and below suffer from an arbitrary file read vulnerability that is leveraged by a server-side request forgery flaw. Exploit Title: PlanyoOnlineReservationSystem 3.0 - Arbitrary File Read via SSRF Date: 12-07-2026 Exploit Author: Balachandar Gowrisanka...
Planyo_Online_Reservation_System 3.0 - Arbitrary File Read via SSRF
Exploit Title: PlanyoOnlineReservationSystem 3.0 - Arbitrary File Read via SSRF Date: 12-07-2026 Exploit Author: Balachandar Gowrisankar Vendor Homepage: https://www.planyo.com/wordpress-reservation-system/ Software Link: https://plugins.svn.wordpress.org/planyo-online-reservation-system/tags/2.9...
WordPress Planyo online reservation system plugin <= 3.0 - Unauthenticated Server-Side Request Forgery vulnerability
Unauthenticated Server-Side Request Forgery vulnerability discovered by chaeyp, Ronnachai Sretawat Na Ayutaya Simonhaskelly, Ronnachai Chaipha rxnr in WordPress Plugin Planyo online reservation system versions = 3.0...
CVE-2026-3576
The Planyo Online Reservation System plugin for WordPress is vulnerable to Server-Side Request Forgery leading to Local File Inclusion in all versions up to, and including, 3.0. The ulap.php file acts as an AJAX proxy and is directly accessible without WordPress bootstrapping or any authenticatio...
CVE-2026-3576
The Planyo Online Reservation System plugin for WordPress is vulnerable to Server-Side Request Forgery leading to Local File Inclusion in all versions up to, and including, 3.0. The ulap.php file acts as an AJAX proxy and is directly accessible without WordPress bootstrapping or any authenticatio...
CVE-2026-3576 Planyo online reservation system <= 3.0 - Unauthenticated Server-Side Request Forgery via 'ulap_url' Parameter
The Planyo Online Reservation System plugin for WordPress is vulnerable to Server-Side Request Forgery leading to Local File Inclusion in all versions up to, and including, 3.0. The ulap.php file acts as an AJAX proxy and is directly accessible without WordPress bootstrapping or any authenticatio...
CVE-2026-3576
CVE-2026-3576 affects the Planyo Online Reservation System plugin for WordPress (versions up to 3.0). The flaw is an unauthenticated Server-Side Request Forgery via the ulap_url AJAX proxy (ulap.php). The allowlist checks a host (e.g., localhost) but does not validate the URL scheme, allowing a c...
EUVD-2026-43137
The Planyo Online Reservation System plugin for WordPress is vulnerable to Server-Side Request Forgery leading to Local File Inclusion in all versions up to, and including, 3.0. The ulap.php file acts as an AJAX proxy and is directly accessible without WordPress bootstrapping or any authenticatio...
CVE-2026-3576 Planyo online reservation system <= 3.0 - Unauthenticated Server-Side Request Forgery via 'ulap_url' Parameter
The Planyo Online Reservation System plugin for WordPress is vulnerable to Server-Side Request Forgery leading to Local File Inclusion in all versions up to, and including, 3.0. The ulap.php file acts as an AJAX proxy and is directly accessible without WordPress bootstrapping or any authenticatio...
CVE-2026-3576: Improper Input Validation
The Planyo Online Reservation System plugin for WordPress is vulnerable to Server-Side Request Forgery leading to Local File Inclusion in all versions up to, and including, 3.0. The ulap.php file acts as an AJAX proxy and is directly accessible without WordPress bootstrapping or any authenticatio...
Wordpress Planyo Online Reservation System Arbitrary File Read (CVE-2026-3576)
This module exploits a Server Side Request Forgery SSRF vulnerability in Wordpress's Planyo Online Reservation System v3.0 or less. The plugin's AJAX proxy ulap.php does not require authentication and does not validate URL scheme supplied via ulapurl parameter. This allows unauthenticated attacke...
EUVD-2025-9226
Malicious code in bioql PyPI...
CVE-2025-31811
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in xtreeme Planyo online reservation system planyo-online-reservation-system allows Stored XSS.This issue affects Planyo online reservation system: from n/a through = 3.1...
WordPress Planyo online reservation system plugin <= 3.0 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by muhammad yudha in WordPress Plugin Planyo online reservation system versions = 3.0...
CVE-2025-31811
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in xtreeme Planyo online reservation system planyo-online-reservation-system allows Stored XSS.This issue affects Planyo online reservation system: from n/a through = 3.1...
CVE-2025-31811 WordPress Planyo online reservation system plugin <= 3.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in xtreeme Planyo online reservation system allows Stored XSS. This issue affects Planyo online reservation system: from n/a through 3.0...
CVE-2025-31811
CVE-2025-31811 describes a Stored Cross-Site Scripting vulnerability in the Planyo online reservation system (Planyo) WordPress plugin up to version 3.0. The issue arises from improper neutralization of input during web page generation, allowing stored XSS. Affected product: Planyo online reserva...
CVE-2025-31811 WordPress Planyo online reservation system plugin <= 3.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in xtreeme Planyo online reservation system planyo-online-reservation-system allows Stored XSS.This issue affects Planyo online reservation system: from n/a through = 3.1...