Advisories · Technology
Salon Booking System.
Every CVE that names Salon Booking System among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 3.7 Low
Salon Booking System < 10.31.11 - Unauthenticated Negative Booking Total via Discount Code
- Salon Booking System
- CWE-20
- CVSS 4.3 Medium
Salon Booking System < 10.31.11 - Subscriber+ Coupon Code Disclosure via Discounts REST Route
- Salon Booking System
- Broken access control
- CVSS 6.8 Medium
Salon Booking System < 10.31.11 - Salon Staff+ Stored XSS and SSRF via Salon REST 'image_url'
- Salon Booking System
- Cross-site scripting (XSS)
- CVSS 5.5 Medium
Salon Booking System < 10.31.11 - Salon Staff+ Administrator Role Demotion via Customer Editor
- Salon Booking System
- Broken access control
- CVSS 7.2 High
Salon Booking System 10.17 - 10.31.10 - Salon Staff+ Privilege Escalation to Administrator via Case-Insensitive User Meta Key
- Salon Booking System
- Privilege escalation
- CVSS 8.8 High
Salon Booking System < 10.31.9 - Administrator Account Creation via CSRF
- Salon Booking System
- Cross-site request forgery (CSRF)
- CVSS 5.3 Medium
Salon Booking System < 10.31.9 - Unauthenticated Booking Creation with Arbitrary Customer ID and Status
- Salon Booking System
- Broken access control
- CVSS 4.8 Medium
Salon Booking System < 10.31.9 - Unauthenticated Salon REST API Access via Predictable Access-Token
- Salon Booking System
- Authentication bypass
- CVSS 4.3 Medium
Salon Booking System < 10.31.3 - Subscriber+ Booking PII Disclosure via REST bookings/upcoming
- Salon Booking System
- Information disclosure
- CVSS 4.8 Medium
Salon Booking System – Free Version <= 10.30.33 - Unauthenticated Google Calendar Connection Hijack via OAuth Callback
- Salon Booking System
- Broken access control
- CVSS 7.5 High
Salon Booking System – Free Version < 10.30.34 - Unauthenticated Booking Information Disclosure via Booking Wizard
- Salon Booking System
- Information disclosure
- CVSS 5.3 Medium
Salon Booking System – Free Version < 10.30.34 - Unauthenticated Arbitrary Booking Total Tampering
- Salon Booking System
- Broken access control
- CVSS 4.3 Medium
Salon Booking System – Free Version <= 10.31.0 - Subscriber+ Arbitrary Booking PII Disclosure
- Salon Booking System
- Broken access control
- CVSS 4.3 Medium
Salon Booking System < 10.30.20 - Subscriber+ Booking Approval Bypass
- Salon Booking System
- CVSS 7.6 High
WordPress Salon Booking System plugin <= 10.7 - Authenticated SQL Injection vulnerability
- Salon booking system
- SQL injection
- CVSS 4.7 Medium
WordPress Salon Booking System plugin <= 10.8.1 - Open Redirection vulnerability
- Salon booking system
- Open redirect
- CVSS 8.6 High
WordPress Salon booking system plugin <= 9.9 - Arbitrary File Deletion vulnerability
- Salon booking system
- Path traversal
- CVSS 6.8 Medium
WordPress Salon booking system plugin < 8.7 - Editor+ Privilege Escalation vulnerability
- Salon booking system
- Privilege escalation
- CVSS 6.3 Medium
Salon booking system <= 9.6.5 - Editor+ Stored XSS via Email Settings
- Salon booking system
- CVSS 4.8 Medium
Salon booking system <= 9.6.5 - Editor+ Stored XSS
- Salon booking system
- CVSS 4.3 Medium
Salon booking system <= 9.6.5 - Settings Update via CSRF
- Salon booking system
- CVSS 4.7 Medium
Salon booking system < 9.6.3 - Unauthenticated Stored XSS
- Salon booking system
- CVSS 5.7 Medium
WordPress Plugin Salon Booking System < 9.6.3 - Unauthenticated Stored Cross-Site Scripting (XSS)
- Salon booking system
- CVSS 10.0 CriticalCritical · CVSS 9+
WordPress Salon booking system plugin <= 9.5 - Arbitrary File Upload vulnerability
- Salon booking system
- Unrestricted file upload
- CVSS 6.1 Medium
Cross-site scripting in Salon booking system
- Salon booking system
- Cross-site scripting (XSS)
-
Salon booking system < 7.6.3 - Customer+ Bookings/Customers Data Disclosure
- Salon booking system
- Salon Booking System Pro
- Broken access control
-
Salon booking system < 7.6.3 - Unauthenticated Sensitive Data Disclosure
- Salon booking system
- Salon Booking System Pro
- Broken access control
-
Salon Booking System < 6.3.1 - Unauthenticated Stored Cross-Site Scripting (XSS)
- Salon booking system
- Cross-site scripting (XSS)