CVE-2026-106000
The Booking Package WordPress plugin before 1.7.34 does not require payment to be completed before saving a booking on calendars configured
CVSS
5.3
Medio
EPSS
—
KEV
—
Exploit Today
0
0-100
Publicado: 4 nov 2026 · Última mod.: 4 nov 2026 · CWE-284
Sin historial EPSS suficiente todavía.
The Booking Package WordPress plugin before 1.7.34 does not require payment to be completed before saving a booking on calendars configured to require online payment, allowing unauthenticated users to create confirmed bookings without paying.
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-1220477.3 ALT—
———A security vulnerability has been detected in Campcodes Complete Advance Loan Management System 1.0. This affects the function move_uploaded_file of the file /loan/application/banner.php. Such manipulation of the argument image leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.4hCVE-2026-1220284.3 MED—
———A vulnerability has been found in NST Labs Tech Nstbrowser 1.21.0. Affected by this vulnerability is an unknown functionality of the file /agent/info of the component Local Agent API. Such manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.4hCVE-2026-976939.9 CRÍ—
———Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platform. From 0.6.0.beta1 until 0.7.1, there is insufficient isolation between execution-capable Docker sandboxes and trusted application services. A low-privileged authenticated user who can execute commands in their own sandbox can reach other tenants' sandbox APIs, access their files and secrets, execute commands in active sandboxes, and enumerate, create, or delete sandboxes through the unauthenticated provisioner without knowing administrator, database, or MinIO credentials. Sandboxes can also reach shared internal services; if shipped default service credentials remain unchanged, an attacker can use them, and if the exposed PostgreSQL account is a superuser, obtain command execution in the PostgreSQL container. These paths can disclose or modify cross-tenant data and sandbox state or cause denial of service through sandbox deletion without a container escape or kernel vulnerability. This vulnerability is fixed in 0.7.1. Existing deployments must separately rotate persisted PostgreSQL, Neo4j, or MinIO credentials that were previously set to documented or shipped defaults because upgrading the Compose files does not automatically rotate them.5hCVE-2026-1102826.5 MED—
———IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to bypass security restrictions due to improper access control.6hCVE-2026-1152575.3 MED—
——0The WP Roster WordPress plugin before 2.36 does not perform any capability or nonce checks before writing its stored roster data, allowing unauthenticated attackers to overwrite, wipe or restore the content of any roster.12hCVE-2026-1152416.5 MED—
——0The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not verify that a submitted snapshot identifier names a snapshot it actually created before using it as a database table-name prefix, so an authenticated administrator can supply the site's table prefix, or any other string, and cause the WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 to drop every matching table, including the core WordPress tables, destroying the site's database.12h