Rox Appointment Booking
Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:rox_appointment_booking:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Rox Appointment Booking (513b7284-637e-5406-8f77-719408ade9ac) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-87892 |
vulnerable | 2026-09-16 04:33:01.661395 |
Rox Appointment Booking < 1.2.0 - Unauthenticated Price Manipulation and Payment Method Restriction Bypass
The Rox Appointment Booking WordPress plugin before 1.2.0 does not verify the order total or the selected payment method against its own server-side pricing when creating a booking, allowing unauthenticated attackers to create confirmed bookings at an arbitrary price and to bypass the site's configured payment-method restrictions.
Published: 2026-09-12T06:00:13.038Z
Updated: 2026-09-12T15:29:10.292Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-87891 |
vulnerable | 2026-09-16 04:33:01.200366 |
Rox Appointment Booking < 1.2.0 - Unauthenticated Holiday Schedule Modification via REST API
The Rox Appointment Booking WordPress plugin before 1.2.0 does not perform any capability or authorization check when saving its holiday schedule, allowing unauthenticated attackers to overwrite the dates the booking system treats as unavailable, which can block legitimate bookings or open dates the site owner intended to keep closed.
Published: 2026-09-12T06:00:12.844Z
Updated: 2026-09-12T15:29:25.825Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-87894 |
vulnerable | 2026-09-16 04:33:01.112609 |
Rox Appointment Booking 1.0.9 - 1.2.2 - Unauthenticated Customer PII Disclosure via IDOR
The Rox Appointment Booking WordPress plugin before 1.2.3 does not perform any authorization check on the endpoint that returns a booking's confirmation details, and each booking is addressed by a sequential numeric identifier, allowing unauthenticated attackers to read any customer's name, email, phone, booking details and payment status by enumerating that identifier.
Published: 2026-09-12T06:00:13.218Z
Updated: 2026-09-12T15:28:54.759Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.