Archivo de vulnerabilidades

Conoce las vulnerabilidades. Protege tus aplicaciones.

Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.

Plataforma

Gravedad

Publicada desde

Publicada hasta

Archivo de vulnerabilidades 32

Restablecer filtros

Alta 09.10.2026

CVE-2026-12626

Plugin Bookly para WordPress <= 28.2 - Inyección autenticada de objetos PHP

El plugin Bookly para WordPress es vulnerable a la inyección de objetos PHP autenticada mediante el parámetro value. Atacantes con permisos de nivel personalizado o superior pueden inyectar objetos PHP, aunque actualmente no se conoce ninguna cadena de gadgets.

Media 09.10.2026

CVE-2026-104898

Online Scheduling and Appointment Booking System <= 28.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Privilege Escalation via 'id' and 'wp_user_id' Parameters via Query String / JSON Body

Media 09.10.2026

CVE-2026-103365

Online Scheduling and Appointment Booking System <= 28.4 - Unauthenticated Sensitive Information Exposure in 'phone' Parameter to bookly_render_details

Media 25.09.2026

CVE-2026-86837

Bookly <= 28.2 - Unauthenticated Insecure Direct Object Reference

Media 25.09.2026

CVE-2026-86839

Bookly <= 28.2 - Authenticated (Staff+) Insecure Direct Object Reference

Alta 25.09.2026

CVE-2026-86841

Bookly 23.2 - 28.2 - Authenticated (Bookly Administrator+) PHP Object Injection

Media 25.09.2026

CVE-2026-86838

Bookly <= 28.2 - Unauthenticated Payment Bypass

Crítica 24.09.2026

CVE-2026-93399

Online Scheduling and Appointment Booking System <= 28.2 - Insecure Direct Object Reference to Unauthenticated Arbitrary Booking Token Disclosure and Deletion via 'order_id' Parameter

Media 24.09.2026

CVE-2026-92799

Online Scheduling and Appointment Booking System <= 28.2 - Unauthenticated Authorization Bypass via PHP Type Juggling via 'verification_code' Parameter Type Juggling via json_data

Media 24.09.2026

CVE-2026-96347

Online Scheduling and Appointment Booking System – Bookly <= 28.2 - Authenticated (Subscriber+) Insecure Direct Object Reference

Media 24.09.2026

CVE-2026-96348

Online Scheduling and Appointment Booking System – Bookly <= 28.2 - Missing Authorization

Media 17.09.2026

CVE-2026-91847

Bookly <= 28.1 - Unauthenticated Insecure Direct Object Reference

Alta 15.09.2026

CVE-2026-89063

Online Scheduling and Appointment Booking System <= 28.1 - Insecure Direct Object Reference to Unauthenticated Sensitive Data Access and Message Injection via 'conversation_id' Parameter

Media 07.09.2026

CVE-2026-2520

Online Scheduling and Appointment Booking System – Bookly <= 27.2 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Plugin Update

Alta 15.08.2026

CVE-2026-13424

Online Scheduling and Appointment Booking System <= 27.7 - Unauthenticated Stored Cross-Site Scripting via bookly_speed_up_update_addons AJAX action

Media 15.08.2026

CVE-2026-12905

Online Scheduling and Appointment Booking System – Bookly <= 27.7 - Authenticated (Staff+) Insecure Direct Object Reference to Sensitive Information Exposure via 'params[id]' Parameter

Alta 03.08.2026

CVE-2026-13395

Online Scheduling and Appointment Booking System – Bookly < 27.8 - Unauthenticated SQL Injection

Alta 27.07.2026

CVE-2026-14516

Online Scheduling and Appointment Booking System <= 27.7 - Unauthenticated SQL Injection

Alta 16.07.2026

CVE-2026-61949

Online Scheduling and Appointment Booking System – Bookly <= 27.7 - Unauthenticated SQL Injection

Alta 16.07.2026

CVE-2026-61944

Online Scheduling and Appointment Booking System – Bookly <= 27.7 - Unauthenticated Stored Cross-Site Scripting

Alta 12.06.2026

CVE-2026-5513

Online Scheduling and Appointment Booking System – Bookly <= 27.2 - Unauthenticated Stored Cross-Site Scripting via 'bookly-customer-full-name' Cookie

Media 10.05.2026

CVE-2026-42667

Online Scheduling and Appointment Booking System – Bookly <= 27.4 - Unauthenticated Information Exposure

Media 08.04.2026

CVE-2026-2519

Online Scheduling and Appointment Booking System – Bookly <= 27.0 - Unauthenticated Price Manipulation via 'tips'

Media 20.03.2026

CVE-2026-32540

Online Scheduling and Appointment Booking System – Bookly <= 26.7 - Reflected Cross-Site Scripting

Mostrando 1 a 24 de 32 resultados

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación

Conoce las vulnerabilidades. Protege tus aplicaciones.

Archivo de vulnerabilidades 32

Identifica las vulnerabilidades de tu aplicación

La seguridad de tus aplicaciones en tu correo