CVE-2021-37333: Bookingcore Booking Core

Critical severity, CVSS 9.8. EPSS: 1.5% chance of exploitation in the next 30 days.

Laravel Booking System Booking Core 2.0 is vulnerable to Session Management. A password change at sandbox.bookingcore.org/user/profile/change-password does not invalidate a session that is opened in a different browser.

Affected products

• Bookingcore Booking Core: version 2.0 only

Published 2021-10-04. Last modified 2026-06-17.