Lucene search
+L

3143 matches found

CVE
CVE
added 2026/07/31 6:00 a.m.47 views

CVE-2026-14333

CVE-2026-14333 affects the Demi WordPress plugin (before 0.0.7). The vulnerability arises because full-site backup archives are stored in a publicly accessible location with a predictable filename and without access protection. This enables unauthenticated attackers to download complete backups, ...

7.5CVSS5.8AI score0.00296EPSS
SaveExploits0References1
NVD
NVD
added 2026/07/30 6:24 a.m.17 views

CVE-2026-13395

The Online Scheduling and Appointment Booking System WordPress plugin before 27.8 does not sanitize or properly cast a user-supplied parameter from its unauthenticated front-end booking requests before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks an...

8.6CVSS0.00339EPSS
SaveExploits0References1
CVE
CVE
added 2026/07/30 6:00 a.m.42 views

CVE-2026-13395

The CVE-2026-13395 entry concerns the WordPress plugin “Online Scheduling and Appointment Booking System” prior to version 27.8. The underlying issue is that a parameter from unauthenticated front-end booking requests is not properly sanitized or cast before being used in a SQL query, enabling un...

8.6CVSS5.9AI score0.00339EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/07/30 6:00 a.m.48 views

CVE-2026-13395 Bookly < 27.8 - Unauthenticated SQL Injection via staff_id

The Online Scheduling and Appointment Booking System WordPress plugin before 27.8 does not sanitize or properly cast a user-supplied parameter from its unauthenticated front-end booking requests before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks an...

0.00339EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
added 2026/07/30 6:00 a.m.13 views

CVE-2026-13395 Bookly < 27.8 - Unauthenticated SQL Injection via staff_id

The Online Scheduling and Appointment Booking System WordPress plugin before 27.8 does not sanitize or properly cast a user-supplied parameter from its unauthenticated front-end booking requests before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks an...

5.9AI score0.00339EPSS
SaveExploits0References1
attackerkb
attackerkb
added 2026/07/30 6:00 a.m.11 views

CVE-2026-13395

The Online Scheduling and Appointment Booking System WordPress plugin before 27.8 does not sanitize or properly cast a user-supplied parameter from its unauthenticated front-end booking requests before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks an...

5.9AI score0.00339EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/07/29 4:22 p.m.24 views

EUVD-2026-43726

Easy!Appointments Vulnerable to Appointments Takeover via Excessive Data Exposure...

7.1CVSS5.8AI score0.00318EPSS
SaveExploits0References4
Github Security Blog
Github Security Blog
added 2026/07/29 4:22 p.m.17 views

Easy!Appointments Vulnerable to Appointments Takeover via Excessive Data Exposure

Summary An Excessive Data Exposure vulnerability in the customers search endpoint allows an authenticated user to obtain appointment hashes belonging to other users. Using these hashes, an attacker can modify or delete appointments of other providers, resulting in an Appointments Takeover. Detail...

7.1CVSS5.9AI score0.00318EPSS
SaveExploits0References5Affected Software1
OSV
OSV
added 2026/07/29 4:22 p.m.12 views

GHSA-4VMM-5QVC-W5P7 Easy!Appointments Vulnerable to Appointments Takeover via Excessive Data Exposure

Summary An Excessive Data Exposure vulnerability in the customers search endpoint allows an authenticated user to obtain appointment hashes belonging to other users. Using these hashes, an attacker can modify or delete appointments of other providers, resulting in an Appointments Takeover. Detail...

7.1CVSS5.9AI score0.00318EPSS
SaveExploits0References5
GitLab Advisory Database
GitLab Advisory Database
added 2026/07/29 12:00 a.m.19 views

Easy!Appointments Vulnerable to Appointments Takeover via Excessive Data Exposure

An Excessive Data Exposure vulnerability in the customers search endpoint allows an authenticated user to obtain appointment hashes belonging to other users. Using these hashes, an attacker can modify or delete appointments of other providers, resulting in an Appointments Takeover...

7.1CVSS5.9AI score0.00318EPSS
SaveExploits0References5Affected Software1
RedhatCVE
RedhatCVE
added 2026/07/28 9:27 p.m.11 views

CVE-2024-5300

A flaw was found in Canonical snapd. The base AppArmor security profile configuration in snapd inadvertently allows strictly confined snap applications to bypass intended sandbox restrictions. This enables a compromised or malicious snap application, when running as root, to access sensitive syst...

5.6CVSS5.8AI score0.00099EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/07/28 8:53 p.m.18 views

EUVD-2026-44800

NocoBase: Sensitive Data Exposure via SQL Blacklist Bypass...

6.8CVSS5.9AI score0.00469EPSS
SaveExploits0References7
Github Security Blog
Github Security Blog
added 2026/07/28 8:53 p.m.18 views

NocoBase: Sensitive Data Exposure via SQL Blacklist Bypass

Security Vulnerability Report: Sensitive Data Exposure via SQL Blacklist Bypass Summary The checkSQL function in plugin-collection-sql implements a keyword-based blacklist to prevent dangerous SQL queries from being executed through the SQL Collection feature. However, the blacklist is incomplete...

6.8CVSS6.2AI score0.00469EPSS
SaveExploits0References8Affected Software1
The Hacker News
The Hacker News
added 2026/07/28 2:41 p.m.18 views

24,650 Internet-Exposed BMCs Disclose IPMI Password Hashes Before Login

Cybersecurity researchers have sounded an alert after finding more than 36,000 Baseboard Management Controller BMC management interfaces exposing Intelligent Platform Management Interface IPMI protocol to the public internet. Of the 36,872 internet-exposed server-management interfaces running IPM...

7.8CVSS7.2AI score0.7499EPSS
SaveExploits3
Tenable Nessus
Tenable Nessus
added 2026/07/25 12:00 a.m.9 views

Linux Distros Unpatched Vulnerability : CVE-2024-5300

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An access control bypass and information disclosure vulnerability exists in the base AppArmor security profile configuration of Canonical snapd. The abstraction...

5.6CVSS5.7AI score0.00099EPSS
SaveExploits0References3
SUSE CVE
SUSE CVE
added 2026/07/23 12:56 a.m.13 views

SUSE CVE-2026-53632

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.1, the launch-editor NPM package accesses arbitrary paths including Windows UNC paths. When a UNC path is opened, Windows automatically attempts NTLM authentication to the remote host, causing the...

5.3CVSS6AI score0.00428EPSS
SaveExploits0References3
OSV
OSV
added 2026/07/22 10:55 p.m.27 views

GHSA-2FVJ-HGJ9-J2GR Eclipse Jetty Digest Authentication: ISO-8859-1 lossy encoding allows authentication bypass via character substitution

Summary The DigestAuthentication.apply method in Jetty's HTTP client uses getBytesStandardCharsets.ISO88591 at three locations lines 171, 179, 196 to compute Digest auth response hashes. ISO-8859-1 silently replaces any character above U+00FF Chinese, Japanese, Cyrillic, Arabic, Emoji, etc. with...

8.7CVSS5.6AI score0.00483EPSS
SaveExploits1References9
NVD
NVD
added 2026/07/21 3:16 p.m.17 views

CVE-2024-5300

An access control bypass and information disclosure vulnerability exists in the base AppArmor security profile configuration of Canonical snapd. The abstraction rules located in /etc/apparmor.d/abstractions/nss-systemd inherited via inadvertently permit strictly confined snap applications, which...

5.6CVSS0.00099EPSS
SaveExploits0References1
OSV
OSV
added 2026/07/21 2:00 p.m.14 views

CVE-2024-5300 AppArmor Base Profile Misconfiguration in snapd Permits Confined Snaps Unauthorized Access to Hashed Passwords via systemd-userdbd

An access control bypass and information disclosure vulnerability exists in the base AppArmor security profile configuration of Canonical snapd. The abstraction rules located in /etc/apparmor.d/abstractions/nss-systemd inherited via inadvertently permit strictly confined snap applications, which...

5.6CVSS5.9AI score
SaveExploits0References12
EUVD
EUVD
added 2026/07/21 2:00 p.m.24 views

EUVD-2024-55693

An access control bypass and information disclosure vulnerability exists in the base AppArmor security profile configuration of Canonical snapd. The abstraction rules located in /etc/apparmor.d/abstractions/nss-systemd inherited via inadvertently permit strictly confined snap applications, which...

5.6CVSS5.5AI score0.00099EPSS
SaveExploits0References1
Rows per page
Query Builder