https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 19:14:39 +0000 https://cve.radiocsirt.org/vuln/cve-2026-11823 <p><strong>Affected:</strong> Repute Infosystems BookingPress Appointment Booking Pro</p> <p>The BookingPress Appointment Booking Pro plugin for WordPress is vulnerable to SQL Injection via the &#39;store_service_date&#39; parameter of the bpa_assign_staffmember_to_slots() function in versions up to and including 5.7.1. This is due to the explicit use of stripslashes_deep() on user-supplied POST data before it is interpolated verbatim into a SQL LIKE clause without use of $wpdb-&gt;prepare() or any parameterization. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.</p> <p><strong>Affected:</strong> Repute Infosystems BookingPress Appointment Booking Pro</p> <p>The BookingPress Appointment Booking Pro plugin for WordPress is vulnerable to SQL Injection via the &#39;store_service_date&#39; parameter of the bpa_assign_staffmember_to_slots() function in versions up to and including 5.7.1. This is due to the explicit use of stripslashes_deep() on user-supplied POST data before it is interpolated verbatim into a SQL LIKE clause without use of $wpdb-&gt;prepare() or any parameterization. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.</p> https://cve.radiocsirt.org/vuln/cve-2026-11823