Salon Booking System
Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:salon_booking_system:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Salon Booking System (111229e7-8aca-59b3-890d-5d5176549073) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-110031 |
vulnerable | 2026-11-03 10:16:01.607424 |
Salon Booking System 10.17 - 10.31.10 - Salon Staff+ Privilege Escalation to Administrator via Case-Insensitive User Meta Key
The Salon Booking System WordPress plugin before 10.31.11 does not prevent users holding its custom salon staff role from assigning arbitrary capabilities to other accounts when editing a customer, allowing them to escalate any account to administrator and take over the site.
Published: 2026-10-18T06:00:15.210Z
Updated: 2026-10-18T11:12:30.988Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-110035 |
vulnerable | 2026-11-03 10:16:01.573283 |
Salon Booking System < 10.31.11 - Subscriber+ Coupon Code Disclosure via Discounts REST Route
The Salon Booking System WordPress plugin before 10.31.11 does not restrict one of its REST API endpoints to salon staff, allowing any authenticated user, such as a subscriber, to retrieve every discount coupon configured on the site, including coupons the administrator has chosen to hide from customers, together with their amounts, validity dates and usage limits.
Published: 2026-10-18T06:00:15.992Z
Updated: 2026-10-18T11:12:30.568Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-110014 |
vulnerable | 2026-11-03 10:16:01.164860 |
Salon Booking System < 10.31.9 - Unauthenticated Booking Creation with Arbitrary Customer ID and Status
The Salon Booking System WordPress plugin before 10.31.9 does not properly check authorization before creating a booking and trusts a caller-supplied user identifier and booking status, allowing unauthenticated attackers to create bookings attributed to arbitrary users, overwrite those users' stored contact details, and mark bookings as paid or confirmed without any payment.
Published: 2026-10-16T06:00:14.661Z
Updated: 2026-10-16T14:49:20.626Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-110015 |
vulnerable | 2026-11-03 10:16:01.063647 |
Salon Booking System < 10.31.9 - Administrator Account Creation via CSRF
The Salon Booking System WordPress plugin before 10.31.9 does not correctly verify the authenticity of REST API requests and discards WordPress core's nonce check for cookie-authenticated sessions across the whole REST API, allowing unauthenticated attackers who trick a logged-in administrator into clicking a crafted link to forge requests in that administrator's browser, up to creating a new administrator account.
Published: 2026-10-16T06:00:14.856Z
Updated: 2026-10-16T14:49:20.475Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-110034 |
vulnerable | 2026-11-03 10:16:00.993262 |
Salon Booking System < 10.31.11 - Unauthenticated Negative Booking Total via Discount Code
LOW (3.7)
The Salon Booking System WordPress plugin before 10.31.11 does not enforce a minimum of zero when subtracting a fixed-amount discount from a booking's total, allowing an unauthenticated visitor who knows a valid discount code to create a confirmed booking stored with a negative total.
Published: 2026-10-19T06:46:14.845Z
Updated: 2026-10-19T09:31:21.812Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-110013 |
vulnerable | 2026-11-03 10:16:00.955378 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-110032 |
vulnerable | 2026-11-03 10:16:00.861187 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-110033 |
vulnerable | 2026-11-03 10:16:00.643373 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-110012 |
vulnerable | 2026-11-03 10:16:00.471729 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-17021 |
vulnerable | 2026-09-16 04:33:03.931279 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-17020 |
vulnerable | 2026-09-16 04:33:03.758956 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-17022 |
vulnerable | 2026-09-16 04:33:03.276001 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-17023 |
vulnerable | 2026-09-16 04:33:02.677693 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-11887 |
vulnerable | 2026-07-29 00:23:31.762856 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-2603 |
vulnerable | 2026-06-08 06:33:31.627296 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-2439 |
vulnerable | 2026-06-08 06:33:31.115982 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-2429 |
vulnerable | 2026-06-08 06:33:31.088768 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-2102 |
vulnerable | 2026-06-08 06:33:30.343060 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-2101 |
vulnerable | 2026-06-08 06:33:30.340709 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-0920 |
vulnerable | 2026-06-08 05:39:11.494945 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-0919 |
vulnerable | 2026-06-08 05:39:11.492908 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.