Medium
CVE-2026-11398
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,329
Reset filters
Medium
CVE-2026-9180
MotoPress Appointment Booking <= 2.4.4 - Unauthenticated Insecure Direct Object Reference to 'payment_details.booking_id' Parameter
High
CVE-2026-57799
Nuss - Hotel Booking WordPress <= 1.3.6 - Authenticated (Contributor+) Local File Inclusion
Medium
CVE-2026-57747
Booked - Appointment Booking for WordPress <= 3.0.0 - Cross-Site Request Forgery
Medium
CVE-2026-57746
Booked - Appointment Booking for WordPress <= 3.0.0 - Missing Authorization
Medium
CVE-2026-57778
Booking calendar, Appointment Booking System <= 3.2.36 - Missing Authorization
Medium
CVE-2026-9188
Appointment Bookings for Zoom GoogleMeet and more – Wappointment <= 2.7.6 - Unauthenticated Insecure Direct Object Reference via Predictable 'edit_key' / 'appointmentkey' Parameter
Medium
CVE-2026-12657
LatePoint <= 5.6.2 - Unauthenticated Insecure Direct Object Reference to Arbitrary Creation via 'service_id' Parameter
Medium
CVE-2026-14322
Timetics <= 1.0.56 - Missing Authorization to Unauthenticated Booking Approval
Medium
CVE-2026-27409
Advanced Booking & Appointment System – Webba Booking Calendar <= 6.4.13 - Missing Authorization
Medium
CVE-2026-57347
MotoPress Hotel Booking <= 6.0.3 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2026-57723
VikBooking Hotel Booking Engine & PMS <= 1.8.12 - Cross-Site Request Forgery
High
CVE-2026-12987
Events Manager <= 7.3.6 - Unauthenticated SQL Injection
High
CVE-2026-13228
LatePoint <= 5.6.3 - Authenticated (Custom+) Privilege Escalation to Administrator via 'order[customer_id]' Parameter
Medium
CVE-2026-12754
VikBooking Hotel Booking Engine & PMS <= 1.8.12 - Reflected Cross-Site Scripting via 'layoutstyle' Parameter
Medium
CVE-2026-13454
MotoPress Appointment Booking <= 2.4.5 - Authenticated (Staff+) SQL Injection via 's' Parameter
High
CVE-2026-11823
BookingPress Appointment Booking Pro <= 5.7.1 - Unauthenticated SQL Injection via 'store_service_date' Parameter
Medium
CVE-2026-12113
Appointment Booking Calendar <= 1.4.02 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Disclosure
High
CVE-2026-57674
Timetics – Appointment Booking Calendar & Scheduling System <= 1.0.58 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-11868
Travel <= 11.7.0 - Missing Authorization
High
CVE-2025-69133
Tour Master - Tour Booking, Travel, Hotel <= 5.4.5 - Authenticated (Subscriber+) Local File Inclusion
High
CVE-2026-57621
Booktics <= 1.0.21 - Unauthenticated PHP Object Injection
Medium
CVE-2025-68052
Eagle Booking <= 1.3.4.3 - Cross-Site Request Forgery
Medium
CVE-2025-66123
BookPro - Appointment Booking WordPress Plugin <= 1.1.0 - Unauthenticated Insecure Direct Object Reference
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.