CVE-2026-89063Suited to automated attack · CISA
Online Scheduling and Appointment Booking System <= 28.1 - Insecure Direct Object Reference to Unauthenticated Sensitive Data Access and Message Injection via 'conversation_id' Parameter
CVSS score
7.5
EPSS probability
%1.6
Risk score
0.1
Published
29 d ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
Nuclei: Bookly <=28.1 - IDOR Unauthenticated Sensitive Data Access
Makefile Go / Python
Similar Vulnerabilities
7.2
CVE-2026-13424
Online Scheduling and Appointment Booking System <= 27.7 - Unauthenticated Stored Cross-Site Scripting via bookly_speed_up_update_addons AJAX action
L
Patch status unknownEPSS %1
9.1
CVE-2026-93399
Online Scheduling and Appointment Booking System <= 28.2 - Insecure Direct Object Reference to Unauthenticated Arbitrary Booking Token Disclosure and Deletion via 'order_id' Parameter
L
Patch status unknownEPSS %0
7.2
CVE-2026-12626
Online Scheduling and Appointment Booking System <= 28.2 - Authenticated (Custom+) PHP Object Injection via 'value' Parameter
L
Patch status unknownEPSS %0
6.8
CVE-2026-104898
Online Scheduling and Appointment Booking System <= 28.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Privilege Escalation via 'id' and 'wp_user_id' Parameters via Query String / JSON Body
L
Patch status unknownEPSS %0
5.3
CVE-2026-92799
Online Scheduling and Appointment Booking System <= 28.2 - Unauthenticated Authorization Bypass via PHP Type Juggling via 'verification_code' Parameter Type Juggling via json_data
L
Patch status unknownEPSS %0
4.3
CVE-2026-12905
Online Scheduling and Appointment Booking System – Bookly <= 27.7 - Authenticated (Staff+) Insecure Direct Object Reference to Sensitive Information Exposure via 'params[id]' Parameter
L
Patch status unknownEPSS %0
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-89063"