Medium
CVE-2026-92421
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 17
Reset filters
Medium
CVE-2026-92420
Hydra Booking <= 1.2.1 - Authenticated (Hydra Host+) Insecure Direct Object Reference
Medium
CVE-2026-92425
Hydra Booking <= 1.2.3 - Authenticated (Hydra Host+) Insecure Direct Object Reference
Medium
CVE-2026-15948
Hydra Booking <= 1.2.2 - Authenticated (Host+) Stored Cross-Site Scripting via 'first_name' Parameter
Medium
CVE-2026-28188
Hydra Booking <= 1.2.2 - Missing Authorization
Medium
CVE-2026-12433
Hydra Booking <= 1.2.1 - Authenticated (Custom+) Insecure Direct Object Reference to Sensitive Information Exposure via 'booking_id' Parameter
High
CVE-2026-57388
Hydra Booking — Appointment Scheduling & Booking Calendar <= 1.1.44 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-42675
Hydra Booking — Appointment Scheduling & Booking Calendar <= 1.1.41 - Missing Authorization
Medium
CVE-2026-39541
Hydra Booking <= 1.1.38 - Authenticated (Hydra host+) Stored Cross-Site Scripting
Critical
CVE-2025-68027
Hydra Booking <= 1.1.32 - Unauthenticated Privilege Escalation
Medium
CVE-2025-68055
Hydra Booking <= 1.1.32 - Authenticated (Custom role+) SQL Injection
Medium
CVE-2025-12788
Hydra Booking – All in One Appointment Booking System | Appointment Scheduling, Booking Calendar & WooCommerce Bookings <= 1.1.27 - Missing Payment Verification to Unauthenticated Payment Bypass
Medium
CVE-2025-12787
Hydra Booking – All in One Appointment Booking System | Appointment Scheduling, Booking Calendar & WooCommerce Bookings <= 1.1.27 - Unauthenticated Arbitrary Booking Cancellation via Weak Hash Generation
High
CVE-2025-7689
Hydra Booking 1.1.0 - 1.1.18 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via tfhb_reset_password_callback Function
Medium
CVE-2025-49377
Hydra Booking <= 1.1.9 - Missing Authorization
Medium
CVE-2025-49378
Hydra Booking <= 1.1.10 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2025-49323
Hydra Booking <= 1.1.10 - Authenticated (Contributor+) SQL Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.