Unknown Online Scheduling and Appointment Booking System

• CVE-2026-86841 Medium 4.7 Bookly 23.2 - 28.2 - Bookly Administrator+ PHP Object Injection via Diagnostics Advanced Options 0.2%
• CVE-2026-86839 Low 3.8 Bookly < 28.3 - Staff+ Appointment and Payment Disclosure, Modification and Deletion via IDOR 0.2%
• CVE-2026-91847 Medium 4.8 Bookly < 28.2 - Unauthenticated AI Assistant Conversation Disclosure and Message Injection via IDOR 0.2%
• CVE-2026-13395 High 8.6 Bookly < 27.8 - Unauthenticated SQL Injection via staff_id 0.4%