exploit-CVE-2022-0482

Easy!Appointments PII disclosure Easy!Appointments --debug exploit.rb -h | --help Options: Root URL base path including HTTP scheme, port and root folder All events since default: 2015-01-11 All events until default: today --debug Display arguments -h, --help Show this screen Examples: exploit.rb...

CVE-2026-40776

CVE-2026-40776 Eventin wp-event-solution Broken Access Control Unauthenticated PII disclosure and order forgery in the Eventin WordPress plugin 10,000+ active installs. A public REST endpoint hands out a wprest nonce to any visitor, and three downstream permission callbacks accept that nonce as a...

CVE-2026-13736

CVE-2026-13736: NewPath WildApricotPress Add-on – Member Directory = 1.0.0 — Unauthenticated Member PII Disclosure via REST API 📖 Advisory Overview CVE-2026-13736 is an unauthenticated Member Personally Identifiable Information PII disclosure vulnerability affecting the NewPath WildApricotPress...

TRUfusion Enterprise <= 7.10.4.0 - Admin Contact Portal

TRUfusion Enterprise versions 7.10.4.0 and earlier contained a vulnerability that allowed unauthenticated access to the Internal Admin Contact Page, resulting in the disclosure of PII including partner and contact names. id: CVE-2025-27225 info: name: TRUfusion Enterprise = 7.10.4.0 - Admin Conta...

CVE-2026-4106

CVE-2026-4106: WordPress HT Mega Unauthenticated PII Disclosure Exploit A robust, multi-threaded Proof of Concept PoC exploit for CVE-2026-4106 , targeting the HT Mega - Absolute Addons for Elementor plugin for WordPress versions 3.0.7. Vulnerability Overview The HT Mega plugin registers several...

CVE-2026-52217-VTEX-Checkout-CrossTenant-IDOR

CVE-2026-52217 Cross-tenant and cross-user authorization flaw IDOR / BOLA in the VTEX Commerce Platform Checkout service. Field| Value ---|--- CVE ID| CVE-2026-52217 Vendor| VTEX Product| VTEX Commerce Platform, Checkout service chk Affected| Observed on chk v2.367.3 and reproduced on v2.374.3. T...

CVE-2025-60357

CVE-2025-60357- NoSQLMongoDB Injection Vulnerability and Product description AhnLab EPP Management is a globally recognized next-generation advanced endpoint protection platform that integrates patch management, advanced malware detection, EDR, and XDR capabilities. NoSQLMongoDB Injection in was...

CVE-2026-105996

The Booking Package WordPress plugin (versions before 1.7.31 ) is vulnerable to an unauthenticated booking PII disclosure and cancellation flaw. The root cause is the use of a non-secure source of randomness to generate booking cancellation tokens; instead, the plugin derives these tokens from pu...

CVE-2026-105996 Booking Package < 1.7.31 - Unauthenticated Booking PII Disclosure and Cancellation via Predictable Token

The Booking Package WordPress plugin before 1.7.31 does not generate booking cancellation tokens using a secure source of randomness, deriving them instead from values it exposes publicly, so an unauthenticated attacker can reconstruct an arbitrary booking's token, disclose that booking's persona...

CVE-2026-105257 LatePoint < 5.7.5 - Agent+ Customer PII Disclosure via IDOR

The Appointment Booking Plugin WordPress plugin before 5.7.5 does not verify that an authenticated agent-level user is assigned to a customer before returning or searching that customer's record, allowing any agent to read and enumerate the personal information of every customer on the site,...

CVE-2026-105996 Booking Package < 1.7.31 - Unauthenticated Booking PII Disclosure and Cancellation via Predictable Token

The Booking Package WordPress plugin before 1.7.31 does not generate booking cancellation tokens using a secure source of randomness, deriving them instead from values it exposes publicly, so an unauthenticated attacker can reconstruct an arbitrary booking's token, disclose that booking's persona...

CVE-2026-105257 LatePoint < 5.7.5 - Agent+ Customer PII Disclosure via IDOR

The Appointment Booking Plugin WordPress plugin before 5.7.5 does not verify that an authenticated agent-level user is assigned to a customer before returning or searching that customer's record, allowing any agent to read and enumerate the personal information of every customer on the site,...

CVE-2026-105257

The LatePoint WordPress plugin (version

WordPress Booking Package plugin < 1.7.31 - Unauthenticated Booking PII Disclosure and Cancellation vulnerability

Unauthenticated Booking PII Disclosure and Cancellation vulnerability discovered by Emiliano Carrizo in WordPress Plugin Booking Package versions 1.7.31...

WordPress Appointment Booking Plugin plugin < 5.7.5 - Agent+ Customer PII Disclosure vulnerability

Agent+ Customer PII Disclosure vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin LatePoint versions 5.7.5...

CVE-2026-94229

The TrueBooker WordPress plugin (versions 1.1.9 through 1.2.9) is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The software fails to verify if a requester owns a specific booking before rendering the confirmation summary. This allows unauthenticated attackers to enumerate bookin...

CVE-2026-94229 TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Customer PII Disclosure via IDOR in 'refappbkd' Parameter

The TrueBooker WordPress plugin before 1.3.0 does not verify that the requester owns a booking before rendering its confirmation summary, allowing unauthenticated attackers to enumerate booking identifiers and retrieve the personal information of customers who booked an appointment, as well as...

WordPress Salon Booking System plugin < 10.31.3 - Subscriber+ Booking PII Disclosure vulnerability

Subscriber+ Booking PII Disclosure vulnerability discovered by Andy Urlep in WordPress Plugin Salon booking system versions 10.31.3...

CVE-2026-110012 Salon Booking System < 10.31.3 - Subscriber+ Booking PII Disclosure via REST bookings/upcoming

The Salon Booking System WordPress plugin before 10.31.3 does not restrict several of its booking REST API routes to users with the appropriate capability, allowing any authenticated user such as a subscriber to read every customer's booking records, including their personal data...

CVE-2026-110012

The Salon Booking System WordPress plugin, in versions before 10.31.3 , contains a vulnerability where several booking REST API routes lack proper capability restrictions. This flaw allows any authenticated user, such as a subscriber , to access and read every customer's booking records, leading ...