Medium
CVE-2026-93928
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,329
Reset filters
Medium
CVE-2026-13471
LatePoint <= 5.6.3 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Booking Deletion and Customer/Booking Data Disclosure via Abilities REST API (list-bookings, list-customers, delete-booking)
Medium
CVE-2026-92561
Booking Calendar <= 11.8.2 - Reflected Cross-Site Scripting via 'options' Parameter
High
CVE-2026-92619
Booking Calendar <= 11.8.2 - Authenticated (Editor+) Privilege Escalation to 'data_name' Parameter
Medium
CVE-2026-18441
LatePoint - Appointment Booking & Scheduling <= 5.6.9 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure via 'customer[id]' Parameter
Medium
CVE-2026-14311
Booking for Appointments and Events Calendar – Amelia (Premium) <= 2.4.4 - Authenticated (Custom+) Missing Authorization to Limited Account Takeover
Medium
CVE-2026-16582
Booking for Appointments and Events Calendar - Amelia <= 2.4.5 - Missing Authorization to Unauthenticated Payment Bypass
Medium
CVE-2026-92421
Hydra Booking <= 1.2.2 - Authenticated (Hydra Host+) Insecure Direct Object Reference
Medium
CVE-2026-91847
Bookly <= 28.1 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2026-92420
Hydra Booking <= 1.2.1 - Authenticated (Hydra Host+) Insecure Direct Object Reference
Medium
CVE-2026-92425
Hydra Booking <= 1.2.3 - Authenticated (Hydra Host+) Insecure Direct Object Reference
Medium
CVE-2026-74002
Booking Calendar <= 11.7 - Missing Authorization
Medium
CVE-2026-89008
Bookit <= 2.6.0.4 - Authenticated (Bookit Staff+) Information Exposure
High
CVE-2026-88825
iGMS Direct Booking <= 1.0 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-89007
Bookit <= 2.6.0.4 - Missing Authorization
High
CVE-2026-85127
VikBooking 1.8.8 - 1.8.14 - Unauthenticated Stored Cross-Site Scripting via SVG Upload
High
CVE-2026-89063
Online Scheduling and Appointment Booking System <= 28.1 - Insecure Direct Object Reference to Unauthenticated Sensitive Data Access and Message Injection via 'conversation_id' Parameter
Critical
CVE-2026-14349
TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary User Email Modification via 'admin_addcustomer' AJAX Action
Critical
CVE-2026-12793
JetFormBuilder <= 3.6.2 - Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameter
High
CVE-2026-90650
MotoPress Hotel Booking <= 6.2.4 - Unauthenticated Stored Cross-Site Scripting via Stripe Webhook Event Object 'id'
Medium
CVE-2026-91019
Event Booking Manager for WooCommerce <= 5.5.0 - Missing Authorization
Medium
CVE-2026-91008
Event Booking Manager for WooCommerce <= 5.3.7 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2026-62101
EduAdmin Booking <= 5.4.2 - Unauthenticated Information Exposure
High
CVE-2026-75983
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.23 - Authenticated (Subscriber+) Privilege Escalation via map_meta_cap Filter
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.