CVE-2026-85225

code-projects Doctor Appointment System 1.0 is affected by a SQL injection vulnerability in the file /patient_login.php , triggered by manipulation of the email argument. The attack is remote and requires no authentication , with a CVSS 3.1 base score of 7.3 (HIGH) . The public proof-of-concept o...

PT-2026-85271

A vulnerability was identified in code-projects Doctor Appointment System 1.0. This vulnerability affects unknown code of the file /patient login.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might b...

CVE-2026-85225: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in code-projects Doctor Appointment System 1.0. This vulnerability affects unknown code of the file /patientlogin.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be...

CVE-2026-14326

The Timetics WordPress plugin through 1.0.61 does not enforce per-object ownership when updating appointments through its REST API, allowing users with its custom staff role to modify, disable, or take over appointments belonging to other staff members...

CVE-2026-14326

The Timetics WordPress plugin through 1.0.61 fails to enforce per-object ownership when updating appointments via its REST API . This allows users holding the plugin's custom staff role to modify, disable, or take over appointments belonging to other staff members. The vulnerability is classified...

CVE-2026-14326 Timetics <= 1.0.61 - Staff+ Cross-Staff Appointment Modification via IDOR

The Timetics WordPress plugin through 1.0.61 does not enforce per-object ownership when updating appointments through its REST API, allowing users with its custom staff role to modify, disable, or take over appointments belonging to other staff members...

CVE-2026-14326 Timetics <= 1.0.61 - Staff+ Cross-Staff Appointment Modification via IDOR

The Timetics WordPress plugin through 1.0.61 does not enforce per-object ownership when updating appointments through its REST API, allowing users with its custom staff role to modify, disable, or take over appointments belonging to other staff members...

EUVD-2026-70034

The Timetics WordPress plugin through 1.0.61 does not enforce per-object ownership when updating appointments through its REST API, allowing users with its custom staff role to modify, disable, or take over appointments belonging to other staff members...

CVE-2026-15232

The MotoPress Appointment Booking WordPress plugin before 2.4.8 does not perform an authorization or ownership check when handling a user-supplied booking identifier on an unauthenticated endpoint, allowing unauthenticated attackers to permanently delete other users' reservations. This is an...

CVE-2026-15232 Appointment Booking Lite < 2.4.8 - Unauthenticated Arbitrary Reservation Deletion

The MotoPress Appointment Booking WordPress plugin before 2.4.8 does not perform an authorization or ownership check when handling a user-supplied booking identifier on an unauthenticated endpoint, allowing unauthenticated attackers to permanently delete other users' reservations. This is an...

WordPress MotoPress Appointment Booking plugin < 2.4.8 - Unauthenticated Arbitrary Reservation Deletion vulnerability

Unauthenticated Arbitrary Reservation Deletion vulnerability discovered by Ahmed Hashim Ismael in WordPress Plugin MotoPress Appointment Booking versions 2.4.8...

CVE-2026-15232

The MotoPress Appointment Booking WordPress plugin, in versions prior to 2.4.8 , contains a vulnerability where it fails to perform authorization or ownership checks when processing a user-supplied booking identifier on an unauthenticated endpoint. This flaw allows unauthenticated attackers to pe...

CVE-2026-15232 Appointment Booking Lite < 2.4.8 - Unauthenticated Arbitrary Reservation Deletion

The MotoPress Appointment Booking WordPress plugin before 2.4.8 does not perform an authorization or ownership check when handling a user-supplied booking identifier on an unauthenticated endpoint, allowing unauthenticated attackers to permanently delete other users' reservations. This is an...

EUVD-2026-69868

The MotoPress Appointment Booking WordPress plugin before 2.4.8 does not perform an authorization or ownership check when handling a user-supplied booking identifier on an unauthenticated endpoint, allowing unauthenticated attackers to permanently delete other users' reservations. This is an...

PT-2026-84606

The MotoPress Appointment Booking WordPress plugin before 2.4.8 does not perform an authorization or ownership check when handling a user-supplied booking identifier on an unauthenticated endpoint, allowing unauthenticated attackers to permanently delete other users' reservations. This is an...

PT-2026-84719

The Timetics WordPress plugin through 1.0.61 does not enforce per-object ownership when updating appointments through its REST API, allowing users with its custom staff role to modify, disable, or take over appointments belonging to other staff members...

CVE-2026-15232: Authorization Bypass Through User-Controlled Key

The MotoPress Appointment Booking WordPress plugin before 2.4.8 does not perform an authorization or ownership check when handling a user-supplied booking identifier on an unauthenticated endpoint, allowing unauthenticated attackers to permanently delete other users' reservations. This is an...

CVE-2026-77704

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not check that a user holds the required capability before letting them change an appointment's status, allowing customers to set arbitrary statuses on appointments they are booked on, including approving their ow...

CVE-2026-76586

The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin before 1.6.3 does not verify the amount actually paid against the server-side price staged for a booking when confirming an online payment, allowing unauthenticated users to have a paid appointment approved for a...

EUVD-2026-68058

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not check that a user holds the required capability before letting them change an appointment's status, allowing customers to set arbitrary statuses on appointments they are booked on, including approving their ow...