{"metadata": {"vulnerability": "CVE-2026-93399", "count": 29, "kinds": {"milestone": 4, "sighting": 15, "kev": 0, "other": 10}, "linked_omitted": 0}, "data": [{"timestamp": "2026-09-17T20:50:36.250Z", "date_only": false, "value": "2026-09-17T20:50:36.250Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-93399", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-17T21:05:40Z", "date_only": false, "value": "2026-09-17T21:05:40.000Z", "kind": "other", "label": "Timeline", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-93399", "field": "containers.cna.timeline.0.time", "text": "Vendor Notified"}, {"timestamp": "2026-09-24T18:12:07Z", "date_only": false, "value": "2026-09-24T18:12:07.000Z", "kind": "other", "label": "Timeline", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-93399", "field": "containers.cna.timeline.1.time", "text": "Disclosed"}, {"timestamp": "2026-09-25T06:39:55.951Z", "date_only": false, "value": "2026-09-25T06:39:55.951Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-93399", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-09-25T06:39:55.951Z", "date_only": false, "value": "2026-09-25T06:39:55.951Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-93399", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-25T07:16:56Z", "date_only": false, "value": "2026-09-25T07:16:56Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-RMC5-XV4J-MVF8", "record": "GHSA-RMC5-XV4J-MVF8", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-09-25T07:16:56.027Z", "date_only": false, "value": "2026-09-25T07:16:56.027", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-93399", "record": "FKIE_CVE-2026-93399", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-09-25T07:18:31.070Z", "date_only": false, "value": "2026-09-25T07:18:31.070485Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwda4ypsys2n", "record": "CVE-2026-93399", "field": "creation_timestamp", "uuid": "29541ace-ae97-40f2-a890-396fa3db9859", "content": "\ud83d\udd34 CVE-2026-93399 - Critical (9.1)\n\nThe Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up ...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-93399/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwda4ypsys2n"}, {"timestamp": "2026-09-25T08:00:08Z", "date_only": false, "value": "2026-09-25T08:00:08.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/103313", "record": "CVE-2026-93399", "field": "creation_timestamp", "uuid": "0e38545d-4fa4-4ec9-843a-549f241e477b", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-93399\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a murrez\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-25 07:53:48\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nUnauthenticated IDOR in Bookly \u2264 28.2: bookly_get_form_id + bookly_render_complete leak any order\u2019s bookly_order token; bookly_add_to_calendar exposes appointments; bookly_rollback_order cancels/deletes non-completed bookings. CVSS 9.1. Python check/exploit PoC \u2014 pocbit.org/pocs/cve-2026-93399\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103313", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-25T08:00:08Z", "date_only": false, "value": "2026-09-25T08:00:08.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/103313", "record": "CVE-2026-93399", "field": "creation_timestamp", "uuid": "f62dd004-4540-4b33-8571-417438f31b1f", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-93399\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a murrez\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-25 07:53:48\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nUnauthenticated IDOR in Bookly \u2264 28.2: bookly_get_form_id + bookly_render_complete leak any order\u2019s bookly_order token; bookly_add_to_calendar exposes appointments; bookly_rollback_order cancels/deletes non-completed bookings. CVSS 9.1. Python check/exploit PoC \u2014 pocbit.org/pocs/cve-2026-93399\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103313"}, {"timestamp": "2026-09-25T08:10:08.675Z", "date_only": false, "value": "2026-09-25T08:10:08.675666Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mwdczdjcm62o", "record": "CVE-2026-93399", "field": "creation_timestamp", "uuid": "9b49b873-f6f3-435c-9d2a-de9a725867eb", "content": "CVE-2026-93399\nThe Bookly scheduling plugin for WordPress versions up to 28.2 can be tricked into revealing other customers' booking details and even removing scheduled appointments without any sign\u2011in. This happens because\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mwdczdjcm62o"}, {"timestamp": "2026-09-25T09:31:06Z", "date_only": false, "value": "2026-09-25T09:31:06Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-RMC5-XV4J-MVF8", "record": "GHSA-RMC5-XV4J-MVF8", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-09-25T09:31:07Z", "date_only": false, "value": "2026-09-25T09:31:07Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-RMC5-XV4J-MVF8", "record": "GHSA-RMC5-XV4J-MVF8", "field": "modified", "linked_record": true}, {"timestamp": "2026-09-25T10:07:31.398Z", "date_only": false, "value": "2026-09-25T10:07:31.398856Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mwdjl7agdm2f", "record": "CVE-2026-93399", "field": "creation_timestamp", "uuid": "4f685791-eb05-48fb-8dad-ed720bfe68b1", "content": "\ud83d\udea8 CVE-2026-93399 \u2014 CVSS 9.1 CRITICAL\n\nThe Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and in...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-93399\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mwdjl7agdm2f"}, {"timestamp": "2026-09-25T10:30:26.651Z", "date_only": false, "value": "2026-09-25T10:30:26.651338Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/117331212741354088", "record": "cve-2026-93399", "field": "creation_timestamp", "uuid": "3bdc0382-4770-481b-b802-42c0ad674008", "content": "CVE-2026-93399 (CRITICAL): Bookly WordPress plugin (\u226428.2) lets unauth'd attackers enumerate, access, and delete bookings via auth bypass in AJAX actions. No patch. Restrict plugin endpoints & monitor for abuse. https://radar.offseq.com/threat/cve-2026-93399-cwe-639-authorization-bypass-through-user-controlled-key-in-ladela-online-scheduling-437a419f1c3d5ec6 #OffSeq #WordPress #Vuln #Cybersecurity", "url": "https://infosec.exchange/users/offseq/statuses/117331212741354088"}, {"timestamp": "2026-09-25T10:30:28.567Z", "date_only": false, "value": "2026-09-25T10:30:28.567776Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mwdkuaths22m", "record": "cve-2026-93399", "field": "creation_timestamp", "uuid": "b9dbda24-5179-4cc1-851f-7989bf0027ca", "content": "Bookly plugin for WordPress (\u226428.2) has a CRITICAL auth bypass (CVE-2026-93399). Unauth'd attackers can access & delete bookings. No patch \u2014 restrict plugin access & monitor for abuse. https://radar.offseq.com/threat/cve-2026-93399-cwe-639-authorization-bypass-through-user-controlled-key-in-ladel...", "url": "https://bsky.app/profile/offseq.bsky.social/post/3mwdkuaths22m"}, {"timestamp": "2026-09-25T11:00:13Z", "date_only": false, "value": "2026-09-25T11:00:13.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/AEwUmxTHfjK52gcCzirRg3eKj4ECkiyGcn3Hrgzjr8KwPNw", "record": "CVE-2026-93399", "field": "creation_timestamp", "uuid": "34196503-4564-4c8c-b4c7-ddeaded6012a", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-25T11:00:13Z", "date_only": false, "value": "2026-09-25T11:00:13.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/AEwUmxTHfjK52gcCzirRg3eKj4ECkiyGcn3Hrgzjr8KwPNw", "record": "CVE-2026-93399", "field": "creation_timestamp", "uuid": "1be4fcb6-1341-4f4c-99d8-0c6dd5c708ed"}, {"timestamp": "2026-09-25T15:00:07Z", "date_only": false, "value": "2026-09-25T15:00:07.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/7GNnqmv7ZdPg7QLWL60eVt3b44pjSw_GS68UUpuiTX3oD9k", "record": "CVE-2026-93399", "field": "creation_timestamp", "uuid": "f9dbff0d-d4ac-4c81-ad1f-20b963060f73", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-25T15:00:07Z", "date_only": false, "value": "2026-09-25T15:00:07.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/7GNnqmv7ZdPg7QLWL60eVt3b44pjSw_GS68UUpuiTX3oD9k", "record": "CVE-2026-93399", "field": "creation_timestamp", "uuid": "07c2c9d2-c8db-420d-ba17-89f97f258257"}, {"timestamp": "2026-09-26T22:41:58.276Z", "date_only": false, "value": "2026-09-26T22:41:58.276787Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-93399", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-09-26T22:41:58.276Z", "date_only": false, "value": "2026-09-26T22:41:58.276787Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-93399", "record": "FKIE_CVE-2026-93399", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-09-26T22:51:19.151Z", "date_only": false, "value": "2026-09-26T22:51:19.151Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-93399", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-09-26T22:51:19.151Z", "date_only": false, "value": "2026-09-26T22:51:19.151Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-93399", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-26T23:16:39.480Z", "date_only": false, "value": "2026-09-26T23:16:39.480", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-93399", "record": "FKIE_CVE-2026-93399", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-10-09T04:24:41.033Z", "date_only": false, "value": "2026-10-09T04:24:41.033982Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/opsmatters.com/post/3mxg4x3c5762y", "record": "CVE-2026-93399", "field": "creation_timestamp", "uuid": "c69b75cf-39d9-48f5-bbba-097f31c03f18", "content": "The latest update for #Sentrium includes \"Critical Bookly IDOR Leads to Booking Disclosure and Deletion (CVE-2026-93399)\" and \"ESP32 Marauder tutorial for WPA2 deauthentication and handshake capture\".\n \n#Cybersecurity #PenTesting #infosec https://opsmtrs.com/3aPKkxS", "url": "https://bsky.app/profile/opsmatters.com/post/3mxg4x3c5762y"}, {"timestamp": "2026-10-17T04:09:59.707Z", "date_only": false, "value": "2026-10-17T04:09:59.707115Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/opsmatters.com/post/3my27u67tpp2f", "record": "CVE-2026-93399", "field": "creation_timestamp", "uuid": "5fd2d579-a3f2-480a-9265-5978e5d34117", "content": "The latest update for #Sentrium includes \"How long does a penetration test take?\" and \"Critical Bookly IDOR Leads to Booking Disclosure and Deletion (CVE-2026-93399)\".\n \n#Cybersecurity #PenTesting #infosec https://opsmtrs.com/3aPKkxS", "url": "https://bsky.app/profile/opsmatters.com/post/3my27u67tpp2f"}, {"timestamp": "2026-10-27T11:00:10Z", "date_only": false, "value": "2026-10-27T11:00:10.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/FMgUKRisBtLQxL16zHY6rh6Fdh98oPAa4W3lmoYf6QoOzHc", "record": "CVE-2026-93399", "field": "creation_timestamp", "uuid": "06e44293-069b-4be8-ada3-8c1d26876340", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-27T11:00:10Z", "date_only": false, "value": "2026-10-27T11:00:10.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/FMgUKRisBtLQxL16zHY6rh6Fdh98oPAa4W3lmoYf6QoOzHc", "record": "CVE-2026-93399", "field": "creation_timestamp", "uuid": "737af4a1-fc67-401b-81e5-ba3205716f8b"}], "metrics": {"as_of": "2026-11-10T22:25:34.613Z", "anchors": {"origin": {"timestamp": "2026-09-25T06:39:55.951Z", "date_only": false, "value": "2026-09-25T06:39:55.951Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-93399", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-09-25T06:39:55.951Z", "date_only": false, "value": "2026-09-25T06:39:55.951Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-93399", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2026-09-25T08:00:08Z", "date_only": false, "value": "2026-09-25T08:00:08.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/103313", "record": "CVE-2026-93399", "field": "creation_timestamp", "uuid": "0e38545d-4fa4-4ec9-843a-549f241e477b", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-93399\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a murrez\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-25 07:53:48\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nUnauthenticated IDOR in Bookly \u2264 28.2: bookly_get_form_id + bookly_render_complete leak any order\u2019s bookly_order token; bookly_add_to_calendar exposes appointments; bookly_rollback_order cancels/deletes non-completed bookings. CVSS 9.1. Python check/exploit PoC \u2014 pocbit.org/pocs/cve-2026-93399\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103313", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": true, "seconds": 4812.049, "hours": 1.3366802777777778, "days": 0.055695011574074076, "min_seconds": 4812.049, "max_seconds": 4812.049, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-09-25T06:39:55.951Z", "date_only": false, "value": "2026-09-25T06:39:55.951Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-93399", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-09-25T08:00:08Z", "date_only": false, "value": "2026-09-25T08:00:08.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/103313", "record": "CVE-2026-93399", "field": "creation_timestamp", "uuid": "0e38545d-4fa4-4ec9-843a-549f241e477b", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-93399\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a murrez\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-25 07:53:48\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nUnauthenticated IDOR in Bookly \u2264 28.2: bookly_get_form_id + bookly_render_complete leak any order\u2019s bookly_order token; bookly_add_to_calendar exposes appointments; bookly_rollback_order cancels/deletes non-completed bookings. CVSS 9.1. Python check/exploit PoC \u2014 pocbit.org/pocs/cve-2026-93399\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103313", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 4031138.662536, "hours": 1119.7607395933333, "days": 46.65669748305555, "min_seconds": 4031138.662536, "max_seconds": 4031138.662536, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-09-25T06:39:55.951Z", "date_only": false, "value": "2026-09-25T06:39:55.951Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-93399", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-10T22:25:34.613Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": true, "seconds": 4026326.613536, "hours": 1118.4240593155555, "days": 46.60100247148148, "min_seconds": 4026326.613536, "max_seconds": 4026326.613536, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-09-25T08:00:08Z", "date_only": false, "value": "2026-09-25T08:00:08.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/103313", "record": "CVE-2026-93399", "field": "creation_timestamp", "uuid": "0e38545d-4fa4-4ec9-843a-549f241e477b", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-93399\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a murrez\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-25 07:53:48\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nUnauthenticated IDOR in Bookly \u2264 28.2: bookly_get_form_id + bookly_render_complete leak any order\u2019s bookly_order token; bookly_add_to_calendar exposes appointments; bookly_rollback_order cancels/deletes non-completed bookings. CVSS 9.1. Python check/exploit PoC \u2014 pocbit.org/pocs/cve-2026-93399\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103313", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-11-10T22:25:34.613Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}