<?xml version='1.0' encoding='UTF-8'?>
<?xml-stylesheet href="/static/style.xsl" type="text/xsl"?>
<rss xmlns:atom="http://www.w3.org/2005/Atom" xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title>Most recent entries from all</title>
    <link>https://vulnerability.circl.lu</link>
    <description>Contains only the most 10 recent entries.</description>
    <docs>http://www.rssboard.org/rss-specification</docs>
    <generator>python-feedgen</generator>
    <language>en</language>
    <lastBuildDate>Fri, 02 Oct 2026 04:44:09 +0000</lastBuildDate>
    <item>
      <title>CVE-2026-14211 — Amelia Pro &lt; 9.7 - Provider+ Arbitrary Customer Data Disclosure and Modification via IDOR</title>
      <link>https://vulnerability.circl.lu/vuln/cve-2026-14211</link>
      <description>&lt;p&gt;&lt;strong&gt;Affected:&lt;/strong&gt; Unknown Booking for Appointments and Events Calendar&lt;/p&gt;
&lt;p&gt;The Booking for Appointments and Events Calendar  WordPress plugin before 9.7 does not verify that an authenticated employee (provider) is related to the customer whose record is being accessed, allowing any employee with an Employee Panel login to read and modify the stored personal data of any customer by enumerating sequential identifiers.&lt;/p&gt;</description>
      <content:encoded>&lt;p&gt;&lt;strong&gt;Affected:&lt;/strong&gt; Unknown Booking for Appointments and Events Calendar&lt;/p&gt;
&lt;p&gt;The Booking for Appointments and Events Calendar  WordPress plugin before 9.7 does not verify that an authenticated employee (provider) is related to the customer whose record is being accessed, allowing any employee with an Employee Panel login to read and modify the stored personal data of any customer by enumerating sequential identifiers.&lt;/p&gt;</content:encoded>
      <guid isPermaLink="false">https://vulnerability.circl.lu/vuln/cve-2026-14211</guid>
    </item>
  </channel>
</rss>
