CVE-2023-6875

CVE-2023-6875 CVE-2023-6875 PoC This is the original proof of concept given to Wordfence for my participation in its Holiday Bug Bonanza An extra was given for this proof of concept code Thank you to Wordfence for the opportunity! I had a lot of fun during the Bug Bonanza and hope that it happens...

EUVD-2026-102475

Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability in HolidayAction.php that allows authenticated users to inject scripts via unescaped holiday names rendered as HtmlString. Attackers permitted to create Public Holidays or Mandatory Days can store JavaScript payloads th...

CVE-2026-111284

Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability in HolidayAction.php that allows authenticated users to inject scripts via unescaped holiday names rendered as HtmlString. Attackers permitted to create Public Holidays or Mandatory Days can store JavaScript payloads th...

CVE-2026-111284 Aureus ERP through 1.6.0 Stored XSS via Time Off Holiday Action Modal

Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability in HolidayAction.php that allows authenticated users to inject scripts via unescaped holiday names rendered as HtmlString. Attackers permitted to create Public Holidays or Mandatory Days can store JavaScript payloads th...

CVE-2026-111284: Improper Neutralization of Input During Web Page Generation

Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability in HolidayAction.php that allows authenticated users to inject scripts via unescaped holiday names rendered as HtmlString. Attackers permitted to create Public Holidays or Mandatory Days can store JavaScript payloads th...

WordPress Rox Appointment Booking plugin < 1.2.0 - Unauthenticated Holiday Schedule Modification vulnerability

Unauthenticated Holiday Schedule Modification vulnerability discovered by Pedro Pinho in WordPress Plugin Rox Appointment Booking Appointment Booking Scheduling Solution versions 1.2.0...

CVE-2026-87891

The Rox Appointment Booking WordPress plugin before 1.2.0 does not perform any capability or authorization check when saving its holiday schedule, allowing unauthenticated attackers to overwrite the dates the booking system treats as unavailable, which can block legitimate bookings or open dates...

CVE-2026-87891 Rox Appointment Booking < 1.2.0 - Unauthenticated Holiday Schedule Modification via REST API

The Rox Appointment Booking WordPress plugin before 1.2.0 does not perform any capability or authorization check when saving its holiday schedule, allowing unauthenticated attackers to overwrite the dates the booking system treats as unavailable, which can block legitimate bookings or open dates...

EUVD-2026-76802

The Rox Appointment Booking WordPress plugin before 1.2.0 does not perform any capability or authorization check when saving its holiday schedule, allowing unauthenticated attackers to overwrite the dates the booking system treats as unavailable, which can block legitimate bookings or open dates...

CVE-2026-87891 Rox Appointment Booking < 1.2.0 - Unauthenticated Holiday Schedule Modification via REST API

The Rox Appointment Booking WordPress plugin before 1.2.0 does not perform any capability or authorization check when saving its holiday schedule, allowing unauthenticated attackers to overwrite the dates the booking system treats as unavailable, which can block legitimate bookings or open dates...

CVE-2026-87891

The Rox Appointment Booking WordPress plugin (versions before 1.2.0 ) is vulnerable to an improper access control issue. The plugin fails to perform necessary capability or authorization checks when saving its holiday schedule via the REST API . This allows unauthenticated attackers to overwrite ...

CVE-2026-87891: Improper Access Control

The Rox Appointment Booking WordPress plugin before 1.2.0 does not perform any capability or authorization check when saving its holiday schedule, allowing unauthenticated attackers to overwrite the dates the booking system treats as unavailable, which can block legitimate bookings or open dates...

PT-2026-90586

Name of the Vulnerable Software and Affected Versions Rox Appointment Booking versions prior to 1.2.0 Description The plugin fails to perform capability or authorization checks when saving the holiday schedule. This allows unauthenticated attackers to overwrite dates treated as unavailable by the...

EUVD-2016-10819

ZKTeco ZKAccess Security System 5.3.1 contains a stored cross-site scripting vulnerability that allows attackers to execute arbitrary HTML and script code by injecting malicious payloads through the 'holidayname' and 'memo' POST parameters. Attackers can submit crafted requests with script code i...

ZKTeco ZKAccess Security System has a cross-site scripting vulnerability

ZKTeco ZKAccess Security System is an access control and security management system developed by ZKTeco Technology. Version 5.3.1 of ZKTeco ZKAccess Security System contains a cross-site scripting vulnerability. This vulnerability arises from improper cleaning of the holidayname and memo POST...

CVE-2016-20032

The CVE-2016-20032 issue affects ZKTeco ZKAccess Security System version 5.3.1. A stored cross-site scripting vulnerability exists in which input supplied to the holiday_name and memo POST parameters is not properly sanitized, allowing an attacker to inject HTML/script that can be executed in a u...

CVE-2016-20032

ZKTeco ZKAccess Security System 5.3.1 contains a stored cross-site scripting vulnerability that allows attackers to execute arbitrary HTML and script code by injecting malicious payloads through the 'holidayname' and 'memo' POST parameters. Attackers can submit crafted requests with script code i...

CVE-2016-20032 ZKTeco ZKAccess Security System 5.3.1 Stored XSS

ZKTeco ZKAccess Security System 5.3.1 contains a stored cross-site scripting vulnerability that allows attackers to execute arbitrary HTML and script code by injecting malicious payloads through the 'holidayname' and 'memo' POST parameters. Attackers can submit crafted requests with script code i...

CVE-2016-20032 ZKTeco ZKAccess Security System 5.3.1 Stored XSS

ZKTeco ZKAccess Security System 5.3.1 contains a stored cross-site scripting vulnerability that allows attackers to execute arbitrary HTML and script code by injecting malicious payloads through the 'holidayname' and 'memo' POST parameters. Attackers can submit crafted requests with script code i...

PT-2026-25730

Name of the Vulnerable Software and Affected Versions ZKTeco ZKAccess Security System version 5.3.1 Description The ZKAccess Security System is susceptible to a stored cross-site scripting issue. This allows attackers to inject malicious payloads through the holiday name and memo POST parameters...