# Salon Booking System.

Every CVE that names Salon Booking System among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Salon Booking System < 10.31.11 - Unauthenticated Negative Booking Total via Discount Code](https://agentprime.io/advisories/CVE-2026-110034.md)
  `CVE-2026-110034` · CVE record: Unknown Salon Booking System · CVSS 3.7 Low · Not analysed yet · Published 19 Oct 2026 · Tags: CWE-20
- [Salon Booking System < 10.31.11 - Subscriber+ Coupon Code Disclosure via Discounts REST Route](https://agentprime.io/advisories/CVE-2026-110035.md)
  `CVE-2026-110035` · CVE record: Unknown Salon Booking System · CVSS 4.3 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Broken access control
- [Salon Booking System < 10.31.11 - Salon Staff+ Stored XSS and SSRF via Salon REST 'image_url'](https://agentprime.io/advisories/CVE-2026-110033.md)
  `CVE-2026-110033` · CVE record: Unknown Salon Booking System · CVSS 6.8 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Salon Booking System < 10.31.11 - Salon Staff+ Administrator Role Demotion via Customer Editor](https://agentprime.io/advisories/CVE-2026-110032.md)
  `CVE-2026-110032` · CVE record: Unknown Salon Booking System · CVSS 5.5 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Broken access control
- [Salon Booking System 10.17 - 10.31.10 - Salon Staff+ Privilege Escalation to Administrator via Case-Insensitive User Meta Key](https://agentprime.io/advisories/CVE-2026-110031.md)
  `CVE-2026-110031` · CVE record: Unknown Salon Booking System · CVSS 7.2 High · Not analysed yet · Published 18 Oct 2026 · Tags: Privilege escalation
- [Salon Booking System < 10.31.9 - Administrator Account Creation via CSRF](https://agentprime.io/advisories/CVE-2026-110015.md)
  `CVE-2026-110015` · CVE record: Unknown Salon Booking System · CVSS 8.8 High · Not analysed yet · Published 16 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Salon Booking System < 10.31.9 - Unauthenticated Booking Creation with Arbitrary Customer ID and Status](https://agentprime.io/advisories/CVE-2026-110014.md)
  `CVE-2026-110014` · CVE record: Unknown Salon Booking System · CVSS 5.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [Salon Booking System < 10.31.9 - Unauthenticated Salon REST API Access via Predictable Access-Token](https://agentprime.io/advisories/CVE-2026-110013.md)
  `CVE-2026-110013` · CVE record: Unknown Salon Booking System · CVSS 4.8 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Authentication bypass
- [Salon Booking System < 10.31.3 - Subscriber+ Booking PII Disclosure via REST bookings/upcoming](https://agentprime.io/advisories/CVE-2026-110012.md)
  `CVE-2026-110012` · CVE record: Unknown Salon Booking System · CVSS 4.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Information disclosure
- [Salon Booking System – Free Version <= 10.30.33 - Unauthenticated Google Calendar Connection Hijack via OAuth Callback](https://agentprime.io/advisories/CVE-2026-17023.md)
  `CVE-2026-17023` · CVE record: Unknown Salon Booking System · CVSS 4.8 Medium · Not analysed yet · Published 10 Aug 2026 · Tags: Broken access control
- [Salon Booking System – Free Version < 10.30.34 - Unauthenticated Booking Information Disclosure via Booking Wizard](https://agentprime.io/advisories/CVE-2026-17022.md)
  `CVE-2026-17022` · CVE record: Unknown Salon Booking System · CVSS 7.5 High · Not analysed yet · Published 10 Aug 2026 · Tags: Information disclosure
- [Salon Booking System – Free Version < 10.30.34 - Unauthenticated Arbitrary Booking Total Tampering](https://agentprime.io/advisories/CVE-2026-17021.md)
  `CVE-2026-17021` · CVE record: Unknown Salon Booking System · CVSS 5.3 Medium · Not analysed yet · Published 10 Aug 2026 · Tags: Broken access control
- [Salon Booking System – Free Version <= 10.31.0 - Subscriber+ Arbitrary Booking PII Disclosure](https://agentprime.io/advisories/CVE-2026-17020.md)
  `CVE-2026-17020` · CVE record: Unknown Salon Booking System · CVSS 4.3 Medium · Not analysed yet · Published 10 Aug 2026 · Tags: Broken access control
- [Salon Booking System < 10.30.20 - Subscriber+ Booking Approval Bypass](https://agentprime.io/advisories/CVE-2026-11887.md)
  `CVE-2026-11887` · CVE record: Unknown Salon Booking System · CVSS 4.3 Medium · Not analysed yet · Published 1 Jul 2026
- [WordPress Salon Booking System plugin <= 10.7 - Authenticated SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2024-39658.md)
  `CVE-2024-39658` · CVE record: Salon Booking System Salon booking system · CVSS 7.6 High · Not analysed yet · Published 29 Aug 2024 · Tags: SQL injection
- [WordPress Salon Booking System plugin <= 10.8.1 - Open Redirection vulnerability](https://agentprime.io/advisories/CVE-2024-43280.md)
  `CVE-2024-43280` · CVE record: Salon Booking System Salon booking system · CVSS 4.7 Medium · Not analysed yet · Published 19 Aug 2024 · Tags: Open redirect
- [WordPress Salon booking system plugin <= 9.9 - Arbitrary File Deletion vulnerability](https://agentprime.io/advisories/CVE-2024-37231.md)
  `CVE-2024-37231` · CVE record: Salon Booking System Salon booking system · CVSS 8.6 High · Not analysed yet · Published 24 Jun 2024 · Tags: Path traversal
- [WordPress Salon booking system plugin < 8.7 - Editor+ Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2023-48319.md)
  `CVE-2023-48319` · CVE record: Salon Booking System Salon booking system · CVSS 6.8 Medium · Not analysed yet · Published 17 May 2024 · Tags: Privilege escalation
- [Salon booking system <= 9.6.5 - Editor+ Stored XSS via Email Settings](https://agentprime.io/advisories/CVE-2024-2603.md)
  `CVE-2024-2603` · CVE record: Unknown Salon booking system · CVSS 6.3 Medium · Not analysed yet · Published 26 Apr 2024
- [Salon booking system <= 9.6.5 - Editor+ Stored XSS](https://agentprime.io/advisories/CVE-2024-2439.md)
  `CVE-2024-2439` · CVE record: Unknown Salon booking system · CVSS 4.8 Medium · Not analysed yet · Published 26 Apr 2024
- [Salon booking system <= 9.6.5 - Settings Update via CSRF](https://agentprime.io/advisories/CVE-2024-2429.md)
  `CVE-2024-2429` · CVE record: Unknown Salon booking system · CVSS 4.3 Medium · Not analysed yet · Published 26 Apr 2024
- [Salon booking system < 9.6.3 - Unauthenticated Stored XSS](https://agentprime.io/advisories/CVE-2024-2102.md)
  `CVE-2024-2102` · CVE record: Unknown Salon booking system · CVSS 4.7 Medium · Not analysed yet · Published 17 Apr 2024
- [WordPress Plugin Salon Booking System < 9.6.3 - Unauthenticated Stored Cross-Site Scripting (XSS)](https://agentprime.io/advisories/CVE-2024-2101.md)
  `CVE-2024-2101` · CVE record: Unknown Salon booking system · CVSS 5.7 Medium · Not analysed yet · Published 17 Apr 2024
- [WordPress Salon booking system plugin <= 9.5 - Arbitrary File Upload vulnerability](https://agentprime.io/advisories/CVE-2024-30510.md)
  `CVE-2024-30510` · CVE record: Salon Booking System Salon booking system · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Mar 2024 · Tags: Unrestricted file upload
- [Cross-site scripting in Salon booking system](https://agentprime.io/advisories/CVE-2022-43487.md)
  `CVE-2022-43487` · CVE record: Salon Booking System Salon booking system · CVSS 6.1 Medium · Not analysed yet · Published 5 Dec 2022 · Tags: Cross-site scripting (XSS)
- [Salon booking system < 7.6.3 - Customer+ Bookings/Customers Data Disclosure](https://agentprime.io/advisories/CVE-2022-0920.md)
  `CVE-2022-0920` · CVE record: Unknown Salon booking system and 1 more · No CVSS score · Not analysed yet · Published 11 Apr 2022 · Tags: Broken access control
- [Salon booking system < 7.6.3 - Unauthenticated Sensitive Data Disclosure](https://agentprime.io/advisories/CVE-2022-0919.md)
  `CVE-2022-0919` · CVE record: Unknown Salon booking system and 1 more · No CVSS score · Not analysed yet · Published 11 Apr 2022 · Tags: Broken access control
- [Salon Booking System < 6.3.1 - Unauthenticated Stored Cross-Site Scripting (XSS)](https://agentprime.io/advisories/CVE-2021-24429.md)
  `CVE-2021-24429` · CVE record: Salon Booking System Salon booking system · No CVSS score · Not analysed yet · Published 12 Jul 2021 · Tags: Cross-site scripting (XSS)

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=salon-booking-system>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/salon-booking-system/>. Everything for agents: <https://agentprime.io/llms.txt>.