Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-57948

Pinpoint - Insecure Session Cookie Attributes in pinpointJwt

Pinpoint through version 3.1.0 contains an insecure session management vulnerability that allows attackers to access the pinpointJwt session cookie due to missing HttpOnly and Secure attributes, enabling JavaScript access via document.cookie and cleartext transmission over HTTP. Attackers can exploit stored or reflected cross-site scripting vulnerabilities to exfiltrate the session token or intercept it through network sniffing to perform session hijacking.

CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Pinpoint Pinpoint-apm Wordpress
Products
Pinpoint Booking System Pinpoint Wordpress
CVE-2026-57947

Pinpoint - Server-Side Request Forgery via Alarm Webhook Registration

Pinpoint through 3.1.0 contains a server-side request forgery vulnerability in the webhook registration endpoint that allows authenticated users to register internal URLs due to missing SSRF protection. Attackers can trigger alarm threshold breaches to force the server to issue POST requests to internal hosts and metadata endpoints, enabling unauthorized access to internal network resources.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Pinpoint Pinpoint-apm Wordpress
Products
Pinpoint Booking System Pinpoint Wordpress