Booking Activities Team vulnerabilities and threats

Unauthenticated PHP Object Injection in Booking Activities <= 1.18.7.1 versions.

Unauthenticated PHP Object Injection in Booking Activities <= 1.18.4 versions.

CVE-2026-39525 is a vulnerability in Booking Activities versions up to and including 1.16.48.1 that involves missing authorization controls. This allows unauthenticated users to perform actions that should require authorization, leading to broken access control. The vulnerability has a medium severity with a CVSS score of 6.5. No official patch or remediation guidance is currently available from the vendor.

Incorrect Privilege Assignment vulnerability in Booking Activities Team Booking Activities booking-activities allows Privilege Escalation.This issue affects Booking Activities: from n/a through <= 1.16.44.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Booking Activities Team Booking Activities allows Reflected XSS.This issue affects Booking Activities: from n/a through 1.15.19.