2042 matches found
WordPress Salon Booking System - Free Version plugin < 10.30.34 - Unauthenticated Arbitrary Booking Total Tampering vulnerability
WordPress Salon Booking System - Free Version plugin 10.30.34 - Unauthenticated Arbitrary Booking Total Tampering vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Salon booking system versions 10.30.34...
CVE-2026-14334
The Booking calendar, Appointment Booking System WordPress plugin through 3.2.36 does not properly sanitize uploaded SVG files, allowing unauthenticated attackers to upload a file that bypasses the Booking calendar, Appointment Booking System WordPress plugin through 3.2.36's script-stripping and...
CVE-2026-14334 Booking calendar, Appointment Booking System <= 3.2.36 - Unauthenticated Stored XSS via SVG File Upload
The Booking calendar, Appointment Booking System WordPress plugin through 3.2.36 does not properly sanitize uploaded SVG files, allowing unauthenticated attackers to upload a file that bypasses the Booking calendar, Appointment Booking System WordPress plugin through 3.2.36's script-stripping and...
CVE-2026-14334
The Booking calendar, Appointment Booking System WordPress plugin (versions up to 3.2.36) fails to sanitize uploaded SVG files, allowing unauthenticated attackers to inject JavaScript that executes in an administrator's session when reviewing a submitted booking. CVSS 3.1 base score is 8.8 (HIGH)...
EUVD-2026-62264
The Booking calendar, Appointment Booking System WordPress plugin through 3.2.36 does not properly sanitize uploaded SVG files, allowing unauthenticated attackers to upload a file that bypasses the Booking calendar, Appointment Booking System WordPress plugin through 3.2.36's script-stripping and...
CVE-2026-73395
Unauthenticated Insecure Direct Object References IDOR in Booking calendar, Appointment Booking System = 3.2.36 versions...
CVE-2026-73395
The WordPress plugin Booking calendar, Appointment Booking System (versions ≤ 3.2.36) has an unauthenticated IDOR flaw, discovered by Jakub Herman, allowing remote attackers to access or modify objects without authentication. CVSS 3.1 scores 6.5 (Medium) with no in-the-wild exploitation reported....
EUVD-2026-60801
Unauthenticated Insecure Direct Object References IDOR in Booking calendar, Appointment Booking System = 3.2.36 versions...
CVE-2026-73395
Unauthenticated Insecure Direct Object References IDOR in Booking calendar, Appointment Booking System = 3.2.36 versions...
WordPress Pinpoint Booking System plugin <= 2.9.9.6.8 - Unauthenticated Improper Input Validation to Price Manipulation via 'cart_data' Parameter vulnerability
Unauthenticated Improper Input Validation to Price Manipulation via 'cartdata' Parameter vulnerability discovered by WordFence in WordPress Plugin Pinpoint Booking System versions = 2.9.9.6.8...
CVE-2026-12128
The Pinpoint Booking System – Version 2 plugin for WordPress is vulnerable to Price Manipulation via the cartdata parameter in all versions up to, and including, 2.9.9.6.8. This is due to the dopbspwoocommerceaddtocart AJAX action being registered via wpajaxnopriv with no authentication, no nonce...
CVE-2026-12128
CVE-2026-12128 affects Pinpoint Booking System – Version 2 for WordPress. The vulnerability allows unauthenticated attackers to manipulate checkout prices for any bookable product linked to a booking calendar by exploiting the WooCommerce price handling flow: the dopbsp_woocommerce_add_to_cart AJ...
EUVD-2026-58843
The Pinpoint Booking System – Version 2 plugin for WordPress is vulnerable to Price Manipulation via the cartdata parameter in all versions up to, and including, 2.9.9.6.8. This is due to the dopbspwoocommerceaddtocart AJAX action being registered via wpajaxnopriv with no authentication, no nonce...
CVE-2026-12128
The Pinpoint Booking System – Version 2 plugin for WordPress is vulnerable to Price Manipulation via the cartdata parameter in all versions up to, and including, 2.9.9.6.8. This is due to the dopbspwoocommerceaddtocart AJAX action being registered via wpajaxnopriv with no authentication, no nonce...
CVE-2026-12128 Pinpoint Booking System <= 2.9.9.6.8 - Unauthenticated Improper Input Validation to Price Manipulation via 'cart_data' Parameter
The Pinpoint Booking System – Version 2 plugin for WordPress is vulnerable to Price Manipulation via the cartdata parameter in all versions up to, and including, 2.9.9.6.8. This is due to the dopbspwoocommerceaddtocart AJAX action being registered via wpajaxnopriv with no authentication, no nonce...
CVE-2026-8840 Booking calendar, Appointment Booking System <= 3.2.36 - Missing Authorization to Unauthenticated Arbitrary Modification via wpdevart_payment AJAX Action
The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.36. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated...
CVE-2026-8840
The CVE-2026-8840 entry concerns the Booking calendar, Appointment Booking System plugin for WordPress, affected up to version 3.2.36. The vulnerability is an authorization bypass caused by inadequate verification of a user’s permission to perform actions, enabling unauthenticated attackers to ma...
PT-2026-72139
Name of the Vulnerable Software and Affected Versions Pinpoint Booking System – Version 2 versions prior to 2.9.9.6.9 Description Unauthenticated attackers can manipulate the checkout price of bookable products tied to a booking calendar. The issue occurs because the dopbsp woocommerce add to car...
CVE-2026-46382
A flaw was found in the Meeting Room Booking System MRBS. This vulnerability, known as Server-Side Request Forgery SSRF, allows a remote attacker to trick the server into making requests to internal or local network resources. By exploiting this, an attacker could potentially gain unauthorized...