L
Vendor security profile
ladela
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs8
Critical1
CISA KEV0
Public exploit1
Patch rate%0
Avg. CVSS6.6
12-month vulnerability rate
0
0
0
0
0
0
0
0
0
2
3
3
CVE KEV
CVE severity distribution
8toplam CVE
Critical1 (13%)
High3 (38%)
Medium4 (50%)
Patch and exploitation view
%0
Verified patch
%0
CISA KEV
%13
Public exploit
0Patch available
0Partial
0Workaround
0Vendor: no patch
8Unknown
Latest vulnerabilities
7.2
CVE-2026-12626
Online Scheduling and Appointment Booking System <= 28.2 - Authenticated (Custom+) PHP Object Injection via 'value' Parameter
L
Patch status unknownEPSS %0
5.3
CVE-2026-103365
Online Scheduling and Appointment Booking System <= 28.4 - Unauthenticated Sensitive Information Exposure in 'phone' Parameter to bookly_render_details
L
Patch status unknownEPSS %0
6.8
CVE-2026-104898
Online Scheduling and Appointment Booking System <= 28.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Privilege Escalation via 'id' and 'wp_user_id' Parameters via Query String / JSON Body
L
Patch status unknownEPSS %0
9.1
CVE-2026-93399
Online Scheduling and Appointment Booking System <= 28.2 - Insecure Direct Object Reference to Unauthenticated Arbitrary Booking Token Disclosure and Deletion via 'order_id' Parameter
L
Patch status unknownEPSS %0
5.3
CVE-2026-92799
Online Scheduling and Appointment Booking System <= 28.2 - Unauthenticated Authorization Bypass via PHP Type Juggling via 'verification_code' Parameter Type Juggling via json_data
L
Patch status unknownEPSS %0
7.5
CVE-2026-89063
Online Scheduling and Appointment Booking System <= 28.1 - Insecure Direct Object Reference to Unauthenticated Sensitive Data Access and Message Injection via 'conversation_id' Parameter
L
Patch status unknownEPSS %2
7.2
CVE-2026-13424
Online Scheduling and Appointment Booking System <= 27.7 - Unauthenticated Stored Cross-Site Scripting via bookly_speed_up_update_addons AJAX action
L
Patch status unknownEPSS %1
4.3
CVE-2026-12905
Online Scheduling and Appointment Booking System – Bookly <= 27.7 - Authenticated (Staff+) Insecure Direct Object Reference to Sensitive Information Exposure via 'params[id]' Parameter
L
Patch status unknownEPSS %0