CVE-2026-92799 Online Scheduling and Appointment Booking System <= 28.2 - Unauthenticated Authorization Bypass via PHP Type Juggling via 'verification_code' Parameter Type Juggling via json_data

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Authorization Bypass via PHP Type Juggling in all versions up to, and including, 28.2. This is due to the postValidateCustomer function using a loose PHP inequality operator != to compare the...

CVE-2026-92799

The Bookly plugin for WordPress is vulnerable to an Authorization Bypass in all versions up to and including 28.2 . The root cause is PHP Type Juggling within the postValidateCustomer() function, which uses a loose inequality operator (!=) to compare a session-stored one-time verification code ag...

CVE-2026-92799 Online Scheduling and Appointment Booking System <= 28.2 - Unauthenticated Authorization Bypass via PHP Type Juggling via 'verification_code' Parameter Type Juggling via json_data

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Authorization Bypass via PHP Type Juggling in all versions up to, and including, 28.2. This is due to the postValidateCustomer function using a loose PHP inequality operator != to compare the...

GHSA-2QFV-WWFX-FH34 paypal/permissions-sdk-php reflected Cross-site Scripting (XSS)

paypal/permissions-sdk-php is vulnerable to reflected XSS in the samples/GetAccessToken.php verificationcode parameter, resulting in code execution...

CVE-2017-6215: Improper Neutralization of Input During Web Page Generation

paypal/permissions-sdk-php is vulnerable to reflected XSS in the samples/GetAccessToken.php verificationcode parameter, resulting in code execution...