8809 matches found
CVE-2026-16536
The Simple Google Calendar Outlook Events Widget WordPress plugin before 3.1.0 does not validate a user-supplied URL before performing a server-side request, allowing unauthenticated attackers to perform Server-Side Request Forgery attacks and, in some cases, read the response of the internal...
CVE-2026-16536 Simple Google Calendar Outlook Events Widget < 3.1.0 - Unauthenticated SSRF via calendar_id
The Simple Google Calendar Outlook Events Widget WordPress plugin before 3.1.0 does not validate a user-supplied URL before performing a server-side request, allowing unauthenticated attackers to perform Server-Side Request Forgery attacks and, in some cases, read the response of the internal...
EUVD-2026-52580
The Simple Google Calendar Outlook Events Widget WordPress plugin before 3.1.0 does not validate a user-supplied URL before performing a server-side request, allowing unauthenticated attackers to perform Server-Side Request Forgery attacks and, in some cases, read the response of the internal...
CVE-2026-16536
The Simple Google Calendar Outlook Events Widget WordPress plugin before 3.1.0 is affected by an unauthenticated Server-Side Request Forgery (SSRF) due to not validating a user-supplied URL before performing a server-side request (via the calendar_id flow). Root cause: absence of URL validation i...
CVE-2026-18648
A vulnerability was detected in Blix Email Blue Mail Calendar App 2.2.305. Impacted is the function FileDirectory.getDataColumn/FileDirectory.getFileFromUri of the component react-native-receive-sharing-intent. The manipulation of the argument displayname results in path traversal. The attack is...
CVE-2026-18648
Blix Email Blue Mail Calendar App 2.2.305 is affected by a path traversal in the component react-native-receive-sharing-intent, specifically FileDirectory.getDataColumn/FileDirectory.getFileFromUri. The vulnerability arises from manipulating the _display_name argument, enabling local access explo...
CVE-2026-18648 Blix Email Blue Mail Calendar App react-native-receive-sharing-intent FileDirectory.getFileFromUri path traversal
A vulnerability was detected in Blix Email Blue Mail Calendar App 2.2.305. Impacted is the function FileDirectory.getDataColumn/FileDirectory.getFileFromUri of the component react-native-receive-sharing-intent. The manipulation of the argument displayname results in path traversal. The attack is...
EUVD-2026-52442
A vulnerability was detected in Blix Email Blue Mail Calendar App 2.2.305. Impacted is the function FileDirectory.getDataColumn/FileDirectory.getFileFromUri of the component react-native-receive-sharing-intent. The manipulation of the argument displayname results in path traversal. The attack is...
CVE-2026-14214
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.4 does not restrict which fields can be written through its customer import, allowing a user with the Amelia Manager role to modify arbitrary columns of any stored user record by supplying them in the import request...
Fedora 44 : php (2026-6131a972fe)
The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-6131a972fe advisory. PHP version 8.5.9 30 Jul 2026 Core: Fixed bug GH-22290 AST pretty printing does not correctly handle strings containing NUL. iliaal Fixed bug GH-222...
CVE-2026-15235 Hotel Booking Lite < 6.0.4 - Subscriber+ Sensitive Data Disclosure via Admin Calendar AJAX Action
The MotoPress Hotel Booking WordPress plugin before 6.0.4 does not perform a capability check before returning a booking's full customer details in one of its AJAX actions, allowing any authenticated user with a low-privileged account Subscriber and above to read the personal data, including name...
CVE-2026-59558
Unauthenticated Cross Site Scripting XSS in Booking Calendar = 11.4.2 versions...
CVE-2026-59558
The CVE-2026-59558 entry documents an unauthenticated Cross Site Scripting (XSS) vulnerability in the WordPress Booking Calendar plugin, affected versions <= 11.4.2. The issue concerns the Booking Calendar component/functionality and is characterized by unauthenticated XSS, allowing an attacke...
EUVD-2026-49225
Unauthenticated Cross Site Scripting XSS in Booking Calendar = 11.4.2 versions...
CVE-2026-59558
Unauthenticated Cross Site Scripting XSS in Booking Calendar = 11.4.2 versions...
CVE-2026-59558 WordPress Booking Calendar plugin <= 11.4.2 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Booking Calendar = 11.4.2 versions...
CVE-2026-14827
The Calendar WordPress plugin before 1.3.18 does not properly escape a user-supplied event field before outputting it inside an HTML attribute on a public-facing page, allowing users with the Contributor role to inject arbitrary JavaScript that executes in the browser of anyone viewing the calend...
CVE-2026-13390
The Events Calendar WordPress plugin before 6.16.5.1 does not perform an authorization check on one of its Event Aggregator import REST API routes and skips an integrity check for a particular status value, allowing unauthenticated attackers to mark existing import records as failed and to store...
WordPress Booking Calendar plugin <= 11.4.2 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin Booking Calendar versions = 11.4.2...
EUVD-2026-49084
The Calendar WordPress plugin before 1.3.18 does not properly escape a user-supplied event field before outputting it inside an HTML attribute on a public-facing page, allowing users with the Contributor role to inject arbitrary JavaScript that executes in the browser of anyone viewing the calend...