All CVEs — page 368 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
The Simply Schedule Appointments WordPress plugin has a missing authorization check that allows unauthenticated users to access sensitive customer appointment data through a recursive parameter, exposing personal information and enabling appointment deletion using public tokens.
The vulnerability allows attackers to read any file accessible to the API process by supplying an absolute file path through the repo_url parameter in the GET /codemap/file endpoint. This bypasses path containment checks and can lead to sensitive data exposure.