https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 22:13:48 +0000 https://cve.radiocsirt.org/vuln/cve-2025-12787 <p><strong>Affected:</strong> themefic Hydra Booking — Appointment Scheduling &amp; Booking Calendar</p> <p>The Hydra Booking — Appointment Scheduling &amp; Booking Calendar plugin for WordPress is vulnerable to unauthorized booking cancellation in all versions up to, and including, 1.1.27. This is due to the plugin&#39;s &#34;tfhb_meeting_form_submit_callback&#34; function using insufficiently random values to generate booking cancellation tokens, combined with a globally shared nonce. This makes it possible for unauthenticated attackers to cancel arbitrary bookings via brute force attacks against the tfhb_meeting_form_cencel AJAX endpoint.</p> <p><strong>Affected:</strong> themefic Hydra Booking — Appointment Scheduling &amp; Booking Calendar</p> <p>The Hydra Booking — Appointment Scheduling &amp; Booking Calendar plugin for WordPress is vulnerable to unauthorized booking cancellation in all versions up to, and including, 1.1.27. This is due to the plugin&#39;s &#34;tfhb_meeting_form_submit_callback&#34; function using insufficiently random values to generate booking cancellation tokens, combined with a globally shared nonce. This makes it possible for unauthenticated attackers to cancel arbitrary bookings via brute force attacks against the tfhb_meeting_form_cencel AJAX endpoint.</p> https://cve.radiocsirt.org/vuln/cve-2025-12787