CVE-2026-14240

The tourmaster WordPress plugin before 5.4.9 writes its order/booking export to a fixed, predictable file inside its publicly accessible directory with no access control, allowing unauthenticated users to download the exported customers' personal information once an administrator has run an expor...

CVE-2026-14240 Tourmaster < 5.4.9 - Unauthenticated Sensitive Data Disclosure via Order Export

The tourmaster WordPress plugin before 5.4.9 writes its order/booking export to a fixed, predictable file inside its publicly accessible directory with no access control, allowing unauthenticated users to download the exported customers' personal information once an administrator has run an expor...

EUVD-2026-53720

The tourmaster WordPress plugin before 5.4.9 writes its order/booking export to a fixed, predictable file inside its publicly accessible directory with no access control, allowing unauthenticated users to download the exported customers' personal information once an administrator has run an expor...

CVE-2026-14240

The CVE-2026-14240 entry affects the Tourmaster WordPress plugin prior to version 5.4.9. The vulnerability arises because order/booking export data is written to a fixed, predictable file inside the plugin’s publicly accessible directory without access control. This allows unauthenticated users t...

CVE-2026-14239

The tourmaster WordPress plugin before 5.4.8 does not perform a nonce check when storing a custom-filter label taken from a request parameter, and does not escape that label when echoing it on the filter admin page, allowing an unauthenticated attacker to trick a logged-in administrator into...

CVE-2026-14239

CVE-2026-14239 : The Tourmaster WordPress plugin prior to 5.4.8 is vulnerable to stored XSS via CSRF. It does not perform a nonce check when storing a custom-filter label from a request parameter, and it does not escape that label when echoing it on the filter admin page. This allows an unauthent...

EUVD-2026-51014

The tourmaster WordPress plugin before 5.4.8 does not perform a nonce check when storing a custom-filter label taken from a request parameter, and does not escape that label when echoing it on the filter admin page, allowing an unauthenticated attacker to trick a logged-in administrator into...

CVE-2026-14239 Tourmaster < 5.4.8 - Stored XSS via CSRF

The tourmaster WordPress plugin before 5.4.8 does not perform a nonce check when storing a custom-filter label taken from a request parameter, and does not escape that label when echoing it on the filter admin page, allowing an unauthenticated attacker to trick a logged-in administrator into...

CVE-2025-69133

Subscriber Local File Inclusion in Tourmaster = 5.4.5 versions...

CVE-2025-69133

CVE-2025-69133 affects the WordPress Tourmaster plugin versions

CVE-2025-69133 WordPress Tourmaster plugin <= 5.4.5 - Local File Inclusion vulnerability

Subscriber Local File Inclusion in Tourmaster = 5.4.5 versions...

CVE-2025-69133

Subscriber Local File Inclusion in Tourmaster = 5.4.5 versions...

PT-2026-54963

Subscriber Local File Inclusion in Tourmaster = 5.4.5 versions...

WordPress Tourmaster plugin <= 5.4.5 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Tourmaster versions = 5.4.5...

EUVD-2025-28204

Malicious code in bioql PyPI...

EUVD-2025-11101

Malicious code in bioql PyPI...

CVE-2025-48292

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in GoodLayers Tourmaster tourmaster allows PHP Local File Inclusion.This issue affects Tourmaster: from n/a through = 5.3.8...

CVE-2025-48292

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in GoodLayers Tourmaster tourmaster allows PHP Local File Inclusion.This issue affects Tourmaster: from n/a through = 5.3.8...

CVE-2025-48292 WordPress Tourmaster plugin <= 5.3.8 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in GoodLayers Tourmaster tourmaster allows PHP Local File Inclusion.This issue affects Tourmaster: from n/a through = 5.3.8...

CVE-2025-48292 WordPress Tourmaster plugin <= 5.3.8 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in GoodLayers Tourmaster tourmaster allows PHP Local File Inclusion.This issue affects Tourmaster: from n/a through = 5.3.8...