Medium
CVE-2025-68515
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,329
Reset filters
Medium
CVE-2026-1674
Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder <= 1.6.0 - Authenticated (Contributor+) Limited Options Update in save_gutena_forms_schema()
High
CVE-2026-22451
Handyman <= 1.4 - Unauthenticated PHP Object Injection
Medium
CVE-2026-1487
LatePoint <= 5.2.7 - Authenticated (Administrator+) SQL Injection via JSON Import
High
CVE-2026-1566
LatePoint <= 5.2.7 - Authenticated (Agent+) Privilege Escalation
Medium
CVE-2026-32432
Time Slots Booking Form <= 1.2.42 - Missing Authorization
Medium
CVE-2026-39586
RepairBuddy <= 4.1132 - Unauthenticated Information Exposure
Medium
CVE-2025-69340
WeDesignTech Ultimate Booking Addon <= 1.0.3 - Missing Authorization
Medium
CVE-2026-27388
DesignThemes Booking Manager <= 2.0 - Missing Authorization
Critical
CVE-2026-27389
WeDesignTech Ultimate Booking Addon <= 1.0.1 - Authentication Bypass
High
CVE-2026-27390
WeDesignTech Ultimate Booking Addon <= 1.0.1 - Authenticated (Subscriber+) Authentication Bypass
Medium
CVE-2026-27428
Eagle Booking <= 1.3.4.3 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2026-39678
Pinpoint Booking System <= 2.9.9.6.5 - Missing Authorization
Medium
CVE-2026-25389
EventPrime <= 4.2.8.3 - Unauthenticated Information Exposure
Medium
CVE-2026-39675
Court Reservation <= 1.10.11 - Missing Authorization
Medium
CVE-2026-1044
Tennis Court Bookings <= 1.2.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via Admin Settings and Calendar Parameters
Medium
CVE-2026-39663
TrueBooker <= 1.1.6 - Missing Authorization
High
CVE-2026-23549
WpEvently <= 5.1.1 - Unauthenticated PHP Object Injection
High
CVE-2026-32384
WpBookingly <= 1.2.9 - Authenticated (Contributor+) Local File Inclusion
Medium
CVE-2026-1655
EventPrime <= 4.2.8.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Event Modification via 'event_id' Parameter
Medium
CVE-2026-1508
Court Reservation – Manage Your Court Bookings Online < 1.10.9 - Cross-Site Request Forgery
Medium
CVE-2026-2230
Booking Calendar <= 10.14.14 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Settings Modification
Medium
CVE-2025-8781
Bookster – WordPress Appointment Booking Plugin <= 2.1.1 - Authenticated (Administrator+) SQL Injection via 'raw'
Medium
CVE-2026-1657
EventPrime <= 4.2.8.4 - Missing Authorization to Unauthenticated Image Upload via 'ep_upload_file_media' AJAX Endpoint
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.