256258 matches found
EUVD-2026-85059
The Event Booking Manager for WooCommerce WordPress plugin before 5.7.3 does not restrict its event listing query to events the requesting user is permitted to read, so users with contributor-level access and above can retrieve other authors' private, draft and trashed events, together with event...
WordPress Event Booking Manager for WooCommerce plugin 5.3.6-5.7.2 - Contributor+ Unpublished Event Disclosure vulnerability
Contributor+ Unpublished Event Disclosure vulnerability discovered by Artus KG in WordPress Plugin WpEvently versions 5.3.6-5.7.2...
WordPress Booking Manager plugin < 2.1.21 - Author+ SQLi vulnerability
Author+ SQLi vulnerability discovered by Mohamed Bassia in WordPress Plugin Booking Manager versions 2.1.21...
EUVD-2026-85056
The Booking Manager WordPress plugin before 2.1.21 does not sanitize and escape values taken from a fetched external iCalendar feed before using them in a SQL query, allowing authenticated users with Author-level access and above to perform SQL injection attacks by importing a feed they control...
CVE-2026-91025 Booking Manager < 2.1.21 - Subscriber+ Arbitrary User Plugin Meta Modification via IDOR
The Booking Manager WordPress plugin before 2.1.21 does not verify that a request to modify a user's Booking Manager WordPress plugin before 2.1.21-specific settings targets the requesting user's own account, allowing any authenticated user with subscriber-level access and above to create or...
CVE-2026-91025
The Booking Manager WordPress plugin, in versions prior to 2.1.21 , is vulnerable to an Insecure Direct Object Reference (IDOR) . The software fails to verify that requests to modify per-user settings target the requesting user's own account. This flaw allows any authenticated user with subscribe...
EUVD-2026-85057
The Booking Manager WordPress plugin before 2.1.21 does not verify that a request to modify a user's Booking Manager WordPress plugin before 2.1.21-specific settings targets the requesting user's own account, allowing any authenticated user with subscriber-level access and above to create or...
CVE-2026-91025 Booking Manager < 2.1.21 - Subscriber+ Arbitrary User Plugin Meta Modification via IDOR
The Booking Manager WordPress plugin before 2.1.21 does not verify that a request to modify a user's Booking Manager WordPress plugin before 2.1.21-specific settings targets the requesting user's own account, allowing any authenticated user with subscriber-level access and above to create or...
WordPress Booking Manager plugin < 2.1.21 - Subscriber+ Arbitrary User Plugin Meta Modification vulnerability
Subscriber+ Arbitrary User Plugin Meta Modification vulnerability discovered by Choriyev Qahramon ciprobe in WordPress Plugin Booking Manager versions 2.1.21...
CVE-2026-91024 Booking Manager < 2.1.21 - Author+ SQLi via ICS Import Feed UID (sync_gid)
The Booking Manager WordPress plugin before 2.1.21 does not sanitize and escape values taken from a fetched external iCalendar feed before using them in a SQL query, allowing authenticated users with Author-level access and above to perform SQL injection attacks by importing a feed they control...
CVE-2026-91024 Booking Manager < 2.1.21 - Author+ SQLi via ICS Import Feed UID (sync_gid)
The Booking Manager WordPress plugin before 2.1.21 does not sanitize and escape values taken from a fetched external iCalendar feed before using them in a SQL query, allowing authenticated users with Author-level access and above to perform SQL injection attacks by importing a feed they control...
CVE-2026-91024
The Booking Manager WordPress plugin (versions before 2.1.21 ) is vulnerable to SQL injection due to improper neutralization of special elements. The root cause is the failure to sanitize and escape values retrieved from a fetched external iCalendar feed before incorporating them into a SQL query...
EUVD-2026-84939
IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to cause a denial of service due to allocation of resources without limits or throttling...
EUVD-2026-84953
IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to execute arbitrary JavaScript in an authenticated user's browser due to improper neutralization of HTML input...
EUVD-2026-84952
IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to perform unauthorized payment mutation actions due to missing authorization...
EUVD-2026-84947
IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to execute arbitrary ESQL commands due to improper neutralization of special elements used in an ESQL command...
EUVD-2026-84937
IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to improper restriction of XML external entity references...
EUVD-2026-84957
IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to execute arbitrary code due to a buffer overflow...