Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Online Scheduling and Appointment Booking System 28.3 Clear all filters
TI-2026-59373 CVE-2026-86841 · GHSA-ggx5-r53p-pf97

Bookly 23.2 - 28.2 - Bookly Administrator+ PHP Object Injection via Diagnostics Advanced Options

Priority LOW 21

The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not prevent deserialization of untrusted input and does not correctly restrict a privileged maintenance feature to administrators, al…

CVSS 3.1MEDIUM 4.7 Network High privileges No interaction EPSS 0.00222 Published 2026-09-27 Fixed in 28.3 CWE-502
TI-2026-59371 CVE-2026-86839 · GHSA-36wf-cx88-gfjh

Bookly < 28.3 - Staff+ Appointment and Payment Disclosure, Modification and Deletion via IDOR

Priority LOW 17

The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not verify that appointment and payment records requested through its staff-role AJAX actions belong to the requesting staff member,…

CVSS 3.1LOW 3.8 Network High privileges No interaction EPSS 0.00169 Published 2026-09-27 Fixed in 28.3 CWE-639