EUVD-2026-100901

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.3 via the bookingid and cartid parameters on the stepsreloadbookingformsummarypanel and stepsstart public...

CVE-2026-100163 Appointment Booking Plugin <= 5.7.2 - Unauthenticated Authentication Bypass to Customer Account Takeover via Insufficient Verification in create_wp_user_for_customer() username_exists Fallback

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.7.2 via the OsCustomerHelper::createwpuserforcustomer helper reached from the public processstepcustomer booking step...

CVE-2026-103366

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) in versions up to and including 5.7.3 . The vulnerability exists because the OsStepsHelper::set_required_objects() function passes raw request parameters to...

CVE-2026-100163

The LatePoint | Calendar & Scheduling for WordPress plugin is vulnerable to an Authentication Bypass in versions up to and including 5.7.2 . The flaw exists in the OsCustomerHelper::create_wp_user_for_customer() helper, which is triggered during the public process_step_customer() booking step. Wh...

CVE-2026-103366 Appointment Booking Plugin <= 5.7.3 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'booking[id]' and 'cart[id]' Parameters

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.3 via the bookingid and cartid parameters on the stepsreloadbookingformsummarypanel and stepsstart public...

CVE-2026-109524

A vulnerability was determined in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected by this issue is some unknown functionality of the file Admin/showdoctor.php of the component Admin Display Pages. This manipulation causes missing authorizatio...

CVE-2026-109523

A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected by this vulnerability is an unknown functionality of the file Admin/getclinic.php of the component AJAX Endpoint. The manipulation of the argument city/cid results i...

CVE-2026-109522

A vulnerability has been found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected is an unknown function of the file Admin/deleteclinic.php of the component Admin CRUD Endpoint. The manipulation of the argument cid/did leads to sql injection...

CVE-2026-109525 girishsaraf Online-Appointment-Booking-System submit2 changebookingstatus.php authorization

A vulnerability was identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects an unknown part of the file changebookingstatus.php of the component submit2 Handler. Such manipulation of the argument username/timestamp/status leads to...

CVE-2026-109525

A vulnerability exists in the girishsaraf Online-Appointment-Booking-System (up to commit f427b4757128ca253d33d0cc4e87bbb9c999a4d5) involving a missing authorization flaw in the submit2 Handler component, specifically within the changebookingstatus.php file. Attackers can remotely manipulate the ...

CVE-2026-109524 girishsaraf Online-Appointment-Booking-System Admin Display Pages showdoctor.php authorization

A vulnerability was determined in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected by this issue is some unknown functionality of the file Admin/showdoctor.php of the component Admin Display Pages. This manipulation causes missing authorizatio...

CVE-2026-109524

The girishsaraf Online-Appointment-Booking-System contains a vulnerability in the Admin/showdoctor.php file within the Admin Display Pages component. This issue stems from missing authorization (CWE-862, CWE-863), allowing for remote manipulation. While the exploit has been publicly disclosed , t...

CVE-2026-109524 girishsaraf Online-Appointment-Booking-System Admin Display Pages showdoctor.php authorization

A vulnerability was determined in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected by this issue is some unknown functionality of the file Admin/showdoctor.php of the component Admin Display Pages. This manipulation causes missing authorizatio...

CVE-2026-109523 girishsaraf Online-Appointment-Booking-System AJAX Endpoint getclinic.php sql injection

A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected by this vulnerability is an unknown functionality of the file Admin/getclinic.php of the component AJAX Endpoint. The manipulation of the argument city/cid results i...

CVE-2026-109523 girishsaraf Online-Appointment-Booking-System AJAX Endpoint getclinic.php sql injection

A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected by this vulnerability is an unknown functionality of the file Admin/getclinic.php of the component AJAX Endpoint. The manipulation of the argument city/cid results i...

CVE-2026-109523

A SQL injection vulnerability exists in the AJAX Endpoint component of the girishsaraf Online-Appointment-Booking-System (affected up to commit f427b4757128ca253d33d0cc4e87bbb9c999a4d5). The flaw is located in the functionality of the Admin/getclinic.php file, where manipulating the city/cid argu...

CVE-2026-109522 girishsaraf Online-Appointment-Booking-System Admin CRUD Endpoint deleteclinic.php sql injection

A vulnerability has been found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected is an unknown function of the file Admin/deleteclinic.php of the component Admin CRUD Endpoint. The manipulation of the argument cid/did leads to sql injection...

CVE-2026-109522 girishsaraf Online-Appointment-Booking-System Admin CRUD Endpoint deleteclinic.php sql injection

A vulnerability has been found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected is an unknown function of the file Admin/deleteclinic.php of the component Admin CRUD Endpoint. The manipulation of the argument cid/did leads to sql injection...

CVE-2026-109522

The girishsaraf Online-Appointment-Booking-System contains a SQL injection vulnerability within the Admin CRUD Endpoint component. Specifically, an unknown function in the Admin/deleteclinic.php file is susceptible to exploitation via the manipulation of the cid/did arguments. This flaw allows fo...

CVE-2026-109521 girishsaraf Online-Appointment-Booking-System changebookingstatus.php sql injection

A vulnerability was detected in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects an unknown function of the file changebookingstatus.php. Performing a manipulation of the argument dateselected results in sql injection. The attack may be...