CVE-2026-119732

Munshi by Petpooja before 2026-07-28 contained a broken object level authorization vulnerability that allows authenticated sub-users to delete invoices belonging to the tenant owner by exploiting the DELETE /api/invoice/invoiceid and POST /api/invoices/bulk-delete endpoints, which only verify...

CVE-2026-119732 Munshi Broken Object Level Authorization via Invoice Deletion API

Munshi by Petpooja before 2026-07-28 contained a broken object level authorization vulnerability that allows authenticated sub-users to delete invoices belonging to the tenant owner by exploiting the DELETE /api/invoice/invoiceid and POST /api/invoices/bulk-delete endpoints, which only verify...

CVE-2026-119732

The Munshi application by Petpooja (versions prior to 2026-07-28) is vulnerable to a broken object level authorization (BOLA) flaw. The vulnerability exists because the DELETE /api/invoice/{invoice_id} and POST /api/invoices/bulk-delete endpoints verify tenant membership but fail to enforce objec...

EUVD-2026-115363

Munshi by Petpooja before 2026-07-28 contained a broken object level authorization vulnerability that allows authenticated sub-users to delete invoices belonging to the tenant owner by exploiting the DELETE /api/invoice/invoiceid and POST /api/invoices/bulk-delete endpoints, which only verify...

CVE-2026-119732: Petpooja Munshi: Munshi (by Petpooja) before 2026-07-28 contained a broken object level authorization vulnerability that allows…

Munshi by Petpooja before 2026-07-28 contained a broken object level authorization vulnerability that allows authenticated sub-users to delete invoices belonging to the tenant owner by exploiting the DELETE /api/invoice/invoiceid and POST /api/invoices/bulk-delete endpoints, which only verify...

CVE-2026-94432

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.1 via the OsPaypalConnectController::createorderfortransaction action registered as a public unauthenticate...

CVE-2026-94432 Appointment Booking Plugin <= 5.7.1 - Insecure Direct Object Reference to Unauthenticated Unauthorized Transaction Intent Creation/Modification and Invoice Enumeration via 'invoice_id' Parameter

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.1 via the OsPaypalConnectController::createorderfortransaction action registered as a public unauthenticate...

CVE-2026-94432 Appointment Booking Plugin <= 5.7.1 - Insecure Direct Object Reference to Unauthenticated Unauthorized Transaction Intent Creation/Modification and Invoice Enumeration via 'invoice_id' Parameter

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.1 via the OsPaypalConnectController::createorderfortransaction action registered as a public unauthenticate...

CVE-2026-94432: Authorization Bypass Through User-Controlled Key

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.1 via the OsPaypalConnectController::createorderfortransaction action registered as a public unauthenticate...

EUVD-2026-34958

The Klamra Paycal for Aspaclaria plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.1.4 via the 'invoiceid' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...

CVE-2026-8611

The Klamra Paycal for Aspaclaria WordPress plugin is vulnerable to Insecure Direct Object Reference through the invoice_id parameter in versions up to 1.1.4, caused by missing validation on a user-controlled key. Authenticated users with subscriber-level access and higher can enumerate post IDs t...

CVE-2026-8611

The Klamra Paycal for Aspaclaria plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.1.4 via the 'invoiceid' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...

CVE-2026-8611: Authorization Bypass Through User-Controlled Key

The Klamra Paycal for Aspaclaria plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.1.4 via the 'invoiceid' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...

CVE-2026-5234: Authorization Bypass Through User-Controlled Key

The LatePoint plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.3.2. The vulnerability exists because the OsStripeConnectController::createpaymentintentfortransaction action is registered as a public action no authentication required an...

EUVD-2025-38446

A security flaw has been discovered in yungifez Skuul School Management System up to 2.6.5. The impacted element is an unknown function of the file /dashboard/fees/fee-invoices/ of the component View Fee Invoice. Performing manipulation of the argument invoiceid results in improper control of...

CVE-2025-12918: Improper Control of Resource Identifiers

A security flaw has been discovered in yungifez Skuul School Management System up to 2.6.5. The impacted element is an unknown function of the file /dashboard/fees/fee-invoices/ of the component View Fee Invoice. Performing manipulation of the argument invoiceid results in improper control of...

mantry.com XSS vulnerability

Vulnerable URL: http://mantry.com/thill/?invoiceid=1id=...

Sql injection

Multiple SQL injection vulnerabilities in index.php in PHPAccounts 0.5 allow remote attackers to execute arbitrary SQL commands via the 1 OutgoingTypeID, 2 OutgoingID, 3 ProjectID, 4 ClientID, 5 InvoiceID, or 6 VendorID parameter...

CVE-2007-3345

Multiple SQL injection vulnerabilities in index.php in PHPAccounts 0.5 allow remote attackers to execute arbitrary SQL commands via the 1 OutgoingTypeID, 2 OutgoingID, 3 ProjectID, 4 ClientID, 5 InvoiceID, or 6 VendorID parameter...