EUVD-2026-96035

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 28.4 via the 'id, wpuserid' parameter due to missing validation on a user controlled key. This makes it possible for...

PT-2026-106256

Name of the Vulnerable Software and Affected Versions openSIS Classic version 9.3 Description An authenticated user with the teacher role can reset the password of any staff account. This is achieved by selecting an arbitrary staff record via the staff id variable within the School Information...