Pinpoint Booking System
Approved changes feed: RSS · Atom
cpe:2.3:a:pinpoint:pinpoint_booking_system:*:*:*:*:*:wordpress:*:*part: a version: * update: *
| Vendor | Pinpoint (0716d94b-3139-53f6-8d87-b58ceb2cb112) |
|---|---|
| Product | Pinpoint Booking System (80d07d50-6bb0-5b83-97d7-01b05ed46146) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | wordpress |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-57948 |
vulnerable | 2026-07-29 01:03:16.453841 |
Pinpoint - Insecure Session Cookie Attributes in pinpointJwt
MEDIUM (6.8)
Pinpoint through version 3.1.0 contains an insecure session management vulnerability that allows attackers to access the pinpointJwt session cookie due to missing HttpOnly and Secure attributes, enabling JavaScript access via document.cookie and cleartext transmission over HTTP. Attackers can exploit stored or reflected cross-site scripting vulnerabilities to exfiltrate the session token or intercept it through network sniffing to perform session hijacking.
Published: 2026-06-29T17:19:11.989Z
Updated: 2026-07-14T21:34:39.461Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-57947 |
vulnerable | 2026-07-29 01:03:16.453388 |
Pinpoint - Server-Side Request Forgery via Alarm Webhook Registration
HIGH (8.5)
Pinpoint through 3.1.0 contains a server-side request forgery vulnerability in the webhook registration endpoint that allows authenticated users to register internal URLs due to missing SSRF protection. Attackers can trigger alarm threshold breaches to force the server to issue POST requests to internal hosts and metadata endpoints, enabling unauthorized access to internal network resources.
Published: 2026-06-29T17:18:50.802Z
Updated: 2026-07-14T21:34:38.750Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-7112 |
vulnerable | 2026-06-08 06:58:21.278570 |
Pinpoint Booking System <= 2.9.9.5.0- Authenticated (Subscriber+) SQL Injection
HIGH (8.8)
The Pinpoint Booking System – #1 WordPress Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the ‘schedule’ parameter in all versions up to, and including, 2.9.9.5.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Published: 2024-09-07T11:17:04.173Z
Updated: 2026-04-08T16:55:07.779Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-3636 |
vulnerable | 2026-06-08 06:43:51.029006 |
Pinpoint Booking System < 2.9.9.4.8 - Admin+ Stored XSS
The Pinpoint Booking System WordPress plugin before 2.9.9.4.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Published: 2024-08-05T06:00:01.893Z
Updated: 2024-08-07T15:58:37.007Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-13235 |
vulnerable | 2026-06-08 06:25:37.036445 |
Pinpoint Booking System – #1 WordPress Booking Plugin <= 2.9.9.5.4 - Authenticated (Subscriber+) SQL Injection
MEDIUM (6.5)
The Pinpoint Booking System – #1 WordPress Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the 'language' parameter in all versions up to, and including, 2.9.9.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Published: 2025-02-21T03:21:19.714Z
Updated: 2026-04-08T16:54:55.377Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-45270 |
vulnerable | 2026-06-08 06:12:42.424016 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-38520 |
vulnerable | 2026-06-08 06:08:18.150965 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-25062 |
vulnerable | 2026-06-08 05:56:08.470338 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-0220 |
vulnerable | 2026-06-08 05:52:04.547083 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2015-9460 |
vulnerable | 2026-06-08 05:07:13.742660 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.