CVE-2026-97248

Unauthenticated PHP Object Injection in Booking Activities <= 1.18.7.1 versions.

Published Sep 30, 2026
CVSS 9.8 critical
0.4% chance of exploitation in the next 30 days (EPSS)

Affected software

Booking Activities Team Booking Activities

CVE-2026-97248 at the National Vulnerability Database