EUVD-2026-91964

The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.19. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possibl...

cve-disclosures

Divulgaciones de CVE — Aman Bahiniya Tres CVE asignados por MITRE en diciembre de 2024. Los registros fueron reservados pero nunca publicados, por lo que aún no hay nada indexado. Este repositorio publica los avisos para que los CVE sean buscables y acreditados. CVE| Producto| Tipo ---|---|---...

CVE-2025-7753

🚨 CVE-2025-7753 — Exploit PoC de Inyección SQL Autor: Byte Reaper Telegram: @ByteReaper0 CVE: CVE‑2025‑7753 Vulnerabilidad: Sin autenticación, Inyección SQL basada en tiempo 🔍 Resumen Existe una vulnerabilidad crítica de Inyección SQL en Online Appointment Booking System 1.0 Code‑Projects en el...

CVE-2026-96886

The Course Booking System WordPress plugin before 7.0.9 does not restrict access to its booking export, allowing unauthenticated users to download the name, email address and billing address of every customer who has booked a course...

CVE-2026-96886 Course Booking System < 7.0.9 - Unauthenticated Attendee PII Disclosure via CSV Export

The Course Booking System WordPress plugin before 7.0.9 does not restrict access to its booking export, allowing unauthenticated users to download the name, email address and billing address of every customer who has booked a course...

EUVD-2026-89626

The Course Booking System WordPress plugin before 7.0.9 does not restrict access to its booking export, allowing unauthenticated users to download the name, email address and billing address of every customer who has booked a course...

CVE-2026-96886

The Course Booking System WordPress plugin, in versions prior to 7.0.9 , contains a vulnerability where it fails to restrict access to its booking export function. This allows unauthenticated users to download sensitive personally identifiable information (PII), including the name, email address,...

CVE-2025-25965

CVE-2025-25965: Falsificación de Solicitudes entre Sitios CSRF en Online Banquet Booking System v1.2 Introducción La Falsificación de Solicitudes entre Sitios CSRF sigue siendo una de las vulnerabilidades más pasadas por alto y, sin embargo, peligrosas que afectan a las aplicaciones web en la...

CVE-2025-22785

CVE-2025-22785 Course Booking System = 6.0.5 - Inyección SQL No Autenticada Descripción El plugin Course Booking System para WordPress es vulnerable a Inyección SQL en versiones hasta la 6.0.5 inclusive, debido a un escape insuficiente en el parámetro proporcionado por el usuario y a la falta de...

CVE-2024-57429

CVE-2024-57429 Una vulnerabilidad de falsificación de solicitudes entre sitios CSRF en la función pjActionUpdate de PHPJabbers Cinema Booking System v2.0 permite a atacantes remotos escalar privilegios engañando a un administrador autenticado para que envíe una solicitud no autorizada. Impacto: L...

CVE-2026-86841

The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not prevent deserialization of untrusted input and does not correctly restrict a privileged maintenance feature to administrators, allowing users granted a custom booking-management capability, which an...

CVE-2026-86839

The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not verify that appointment and payment records requested through its staff-role AJAX actions belong to the requesting staff member, allowing authenticated attackers with a staff-level account to view, modify a...

EUVD-2026-87891

The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not prevent deserialization of untrusted input and does not correctly restrict a privileged maintenance feature to administrators, allowing users granted a custom booking-management capability, which an...

EUVD-2026-87890

The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not verify that appointment and payment records requested through its staff-role AJAX actions belong to the requesting staff member, allowing authenticated attackers with a staff-level account to view, modify a...

CVE-2025-46181-XSS

CVE-2025-46181 - XSS reflejado en un sistema de reserva de citas en línea CVE-ID : CVE-2025-46181 Descubierto por : Shemkumar P shemkumar.github.io Tipo de vulnerabilidad : Cross-Site Scripting XSS reflejado Severidad : Media Estado : Divulgado, CVE asignado por MITRE ✨ Descripción Existe una...

CVE-2026-91847

The Online Scheduling and Appointment Booking System WordPress plugin before 28.2 does not verify that the requester owns the AI booking-assistant conversation named in its unauthenticated conversation actions, allowing any unauthenticated visitor to read another visitor's assistant messages and ...

EUVD-2026-83509

The Online Scheduling and Appointment Booking System WordPress plugin before 28.2 does not verify that the requester owns the AI booking-assistant conversation named in its unauthenticated conversation actions, allowing any unauthenticated visitor to read another visitor's assistant messages and ...

CVE-2026-91847: Authorization Bypass Through User-Controlled Key

The Online Scheduling and Appointment Booking System WordPress plugin before 28.2 does not verify that the requester owns the AI booking-assistant conversation named in its unauthenticated conversation actions, allowing any unauthenticated visitor to read another visitor's assistant messages and ...

PT-2026-95762

Name of the Vulnerable Software and Affected Versions Online Scheduling and Appointment Booking System WordPress plugin versions prior to 28.2 Description The plugin fails to verify if the requester is the owner of the AI booking-assistant conversation during unauthenticated conversation actions...

CVE-2026-81793

Missing Authorization vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Salon booking system: from n/a through 10.31.8...