CVE-2025-22785

CVE-2025-22785 Course Booking System = 6.0.5 - Unauthenticated SQL Injection Description The Course Booking System plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 6.0.5 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2025-46181-XSS

CVE-2025-46181 - Reflected XSS in an Online Appointment Booking System CVE-ID : CVE-2025-46181 Discovered by : Shemkumar P shemkumar.github.io Vulnerability Type : Reflected Cross-Site Scripting XSS Severity : Medium Status : Disclosed, CVE Assigned by MITRE ✨ Description A Reflected Cross-Site...

CVE-2026-75028

The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.18 via the template scope function. This makes it possible for authenticated attackers, with contributor-level access and...

CVE-2026-11601

The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.19. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possibl...

EUVD-2026-91964

The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.19. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possibl...

CVE-2026-75028

The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion (LFI) in all versions up to and including 3.0.18 . The vulnerability exists within the (template scope) function , specifically related to the 'food_menu_style' Ele...

cve-disclosures

CVE 開示 — Aman Bahiniya 2024年12月にMITREから割り当てられた3件のCVE。レコードは予約されたものの公開されていないため、まだ何もインデックスされていません。このリポジトリはアドバイザリを公開し、CVEが検索可能でクレジット付きになるようにします。 CVE| 製品| 種別 ---|---|--- CVE-2024-57551| Online Food Ordering System v2.0| 任意ファイルアップロード → RCE CVE-2024-57552| Online Food Ordering System v2.0| 格納型XSS...

CVE-2025-7753

🚨 CVE-2025-7753 — SQL 인젝션 PoC 익스플로잇 저자: Byte Reaper 텔레그램: @ByteReaper0 CVE: CVE‑2025‑7753 취약점: 인증되지 않은 사용자의 시간 기반 SQL 인젝션 🔍 개요 Online Appointment Booking System 1.0 Code‑Projects의 /admin/adddoctor.php 파일에 심각한 SQL 인젝션 취약점이 존재합니다. username 매개변수가 적절히 검증되지 않아, 원격 공격자가 임의의 SQL 쿼리시간 기반, 오류 기반, UNION 기반...

CVE-2026-96886

The Course Booking System WordPress plugin before 7.0.9 does not restrict access to its booking export, allowing unauthenticated users to download the name, email address and billing address of every customer who has booked a course...

EUVD-2026-89626

The Course Booking System WordPress plugin before 7.0.9 does not restrict access to its booking export, allowing unauthenticated users to download the name, email address and billing address of every customer who has booked a course...

CVE-2026-96886

The Course Booking System WordPress plugin, in versions prior to 7.0.9 , contains a vulnerability where it fails to restrict access to its booking export function. This allows unauthenticated users to download sensitive personally identifiable information (PII), including the name, email address,...

CVE-2026-96886 Course Booking System < 7.0.9 - Unauthenticated Attendee PII Disclosure via CSV Export

The Course Booking System WordPress plugin before 7.0.9 does not restrict access to its booking export, allowing unauthenticated users to download the name, email address and billing address of every customer who has booked a course...

CVE-2025-25965

CVE-2025-25965: Online Banquet Booking System v1.2의 사이트 간 요청 위조CSRF 소개 사이트 간 요청 위조CSRF는 오늘날 웹 애플리케이션에 영향을 미치는 가장 간과되면서도 위험한 취약점 중 하나로 남아 있습니다. CVE-2025-25965 는 Phpgurukul Online Banquet Booking System v1.2 에서 새로 발견된 CSRF 취약점으로, 원격 공격자가 인증된 세션을 악용하여 사용자의 동의 없이 이메일 주소를 변경할 수 있게 합니다. 취약점 개요 CVE ID :...

CVE-2024-57429

CVE-2024-57429 A cross-site request forgery CSRF vulnerability in the pjActionUpdate function of PHPJabbers Cinema Booking System v2.0 allows remote attackers to escalate privileges by tricking an authenticated admin into submitting an unauthorized request. Impact: Exploitation of this CSRF...

CVE-2026-86841

The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not prevent deserialization of untrusted input and does not correctly restrict a privileged maintenance feature to administrators, allowing users granted a custom booking-management capability, which an...

CVE-2026-86839

The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not verify that appointment and payment records requested through its staff-role AJAX actions belong to the requesting staff member, allowing authenticated attackers with a staff-level account to view, modify a...

EUVD-2026-87891

The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not prevent deserialization of untrusted input and does not correctly restrict a privileged maintenance feature to administrators, allowing users granted a custom booking-management capability, which an...

EUVD-2026-87890

The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not verify that appointment and payment records requested through its staff-role AJAX actions belong to the requesting staff member, allowing authenticated attackers with a staff-level account to view, modify a...

CVE-2026-91847

The Online Scheduling and Appointment Booking System WordPress plugin before 28.2 does not verify that the requester owns the AI booking-assistant conversation named in its unauthenticated conversation actions, allowing any unauthenticated visitor to read another visitor's assistant messages and ...

EUVD-2026-83509

The Online Scheduling and Appointment Booking System WordPress plugin before 28.2 does not verify that the requester owns the AI booking-assistant conversation named in its unauthenticated conversation actions, allowing any unauthenticated visitor to read another visitor's assistant messages and ...