150 matches found
CVE-2025-68055-poc
CVE-2025-68055 Hydra Booking 插件（get 函数中传入数组类型时，Hydra Booking 会将用户输入直接硬编码到原始 SQL 请求中，而不是使用 prepare 来清理输入，从而导致基于时间的盲 SQL 注入。 漏洞利用 如下所示的简单运行命令将告诉您正在运行的 wordpress 实例是否存在漏洞： root@kitploit: ./CVE-2025-68055.py --url --login --password Exploit options : --list-users --dump-password...
CVE-2026-92425
The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.4 does not perform object-level authorisation checks on several of its host-management operations, allowing users who hold its own administrator-assigned custom role to read, modify and permanently delete...
CVE-2026-92421
The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.3 does not verify that the host record being modified belongs to the user making the request, allowing authenticated users holding a Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin...
CVE-2026-92420
The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.2 does not verify that a booking belongs to the requesting user before modifying or deleting it on two of its booking endpoints, allowing a booking-provider-level user to cancel and permanently delete other...
CVE-2026-92420 Hydra Booking < 1.2.2 - Hydra Host+ Cross-Host Booking Deletion and Modification via IDOR
The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.2 does not verify that a booking belongs to the requesting user before modifying or deleting it on two of its booking endpoints, allowing a booking-provider-level user to cancel and permanently delete other...
EUVD-2026-83515
The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.4 does not perform object-level authorisation checks on several of its host-management operations, allowing users who hold its own administrator-assigned custom role to read, modify and permanently delete...
EUVD-2026-83514
The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.3 does not verify that the host record being modified belongs to the user making the request, allowing authenticated users holding a Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin...
CVE-2026-92421
CVE-2026-92421 affects the Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin (versions 1.1.0–1.2.2 ), fixed in 1.2.3 . The vulnerability is an IDOR (Insecure Direct Object Reference) in the host profile management feature: the plugin fails to verify that the host record b...
CVE-2026-92420 Hydra Booking < 1.2.2 - Hydra Host+ Cross-Host Booking Deletion and Modification via IDOR
The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.2 does not verify that a booking belongs to the requesting user before modifying or deleting it on two of its booking endpoints, allowing a booking-provider-level user to cancel and permanently delete other...
CVE-2026-92420
CVE-2026-92420 affects the Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin in versions prior to 1.2.2 . The vulnerability is an IDOR (Insecure Direct Object Reference) on two of the plugin's booking endpoints: the plugin fails to verify that a booking belongs to the req...
CVE-2026-92425 Hydra Booking < 1.2.4 - Hydra Host+ Cross-Host Account Modification and Deletion via IDOR
The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.4 does not perform object-level authorisation checks on several of its host-management operations, allowing users who hold its own administrator-assigned custom role to read, modify and permanently delete...
WordPress Hydra Booking — Appointment Scheduling & Booking Calendar plugin 1.1.0-1.2.2 - Hydra Host+ Host Profile Takeover vulnerability
Hydra Host+ Host Profile Takeover vulnerability discovered by Ossacip Thanh in WordPress Plugin Hydra Booking versions 1.1.0-1.2.2...
EUVD-2026-83513
The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.2 does not verify that a booking belongs to the requesting user before modifying or deleting it on two of its booking endpoints, allowing a booking-provider-level user to cancel and permanently delete other...
CVE-2026-92425 Hydra Booking < 1.2.4 - Hydra Host+ Cross-Host Account Modification and Deletion via IDOR
The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.4 does not perform object-level authorisation checks on several of its host-management operations, allowing users who hold its own administrator-assigned custom role to read, modify and permanently delete...
CVE-2026-92425
The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.4 does not perform object-level authorisation checks on several of its host-management operations, allowing users who hold its own administrator-assigned custom role to read, modify and permanently delete...
CVE-2026-92421 Hydra Booking 1.1.0 - < 1.2.3 - Hydra Host+ Host Profile Takeover via IDOR
The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.3 does not verify that the host record being modified belongs to the user making the request, allowing authenticated users holding a Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin...
CVE-2026-92421 Hydra Booking 1.1.0 - < 1.2.3 - Hydra Host+ Host Profile Takeover via IDOR
The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.3 does not verify that the host record being modified belongs to the user making the request, allowing authenticated users holding a Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin...
WordPress Hydra Booking — Appointment Scheduling & Booking Calendar plugin < 1.2.2 - Hydra Host+ Cross-Host Booking Deletion and Modification vulnerability
Hydra Host+ Cross-Host Booking Deletion and Modification vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Hydra Booking versions 1.2.2...
WordPress Hydra Booking — Appointment Scheduling & Booking Calendar plugin < 1.2.4 - Hydra Host+ Cross-Host Account Modification and Deletion vulnerability
Hydra Host+ Cross-Host Account Modification and Deletion vulnerability discovered by Stefan Spasic in WordPress Plugin Hydra Booking versions 1.2.4...
CVE-2026-92420: Authorization Bypass Through User-Controlled Key
The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.2 does not verify that a booking belongs to the requesting user before modifying or deleting it on two of its booking endpoints, allowing a booking-provider-level user to cancel and permanently delete other...