CVE-2026-13161

Name of the Vulnerable Software and Affected Versions TrueBooker – Appointment Booking and Scheduler System versions prior to 1.2.3

Description An issue exists where unauthenticated attackers can append additional SQL queries to existing ones to extract sensitive information from the database. This occurs due to insufficient escaping of user-supplied parameters and a lack of proper preparation of the SQL query. The flaw is triggered via the alldata[truebooker user] parameter. Exploitation requires that the alldata POST parameter includes specific booking fields: category, service, person, date, and time slot. The check ajax referer() nonce guard does not prevent this attack because the nonce is exposed to unauthenticated visitors on the front-end booking pages.

Recommendations Update to a version newer than 1.2.2. As a temporary mitigation, restrict or monitor the use of the alldata[truebooker user] parameter in POST requests.