Salon Booking System
Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:salon_booking_system:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Salon Booking System (111229e7-8aca-59b3-890d-5d5176549073) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-17021 |
vulnerable | 2026-09-16 04:33:03.931279 |
Salon Booking System – Free Version < 10.30.34 - Unauthenticated Arbitrary Booking Total Tampering
The Salon Booking System WordPress plugin before 10.30.34 does not properly restrict access to some of its booking-modification AJAX actions and does not verify ownership of the targeted booking, allowing unauthenticated users to tamper with the stored total of arbitrary bookings.
Published: 2026-08-10T06:00:17.803Z
Updated: 2026-08-13T13:02:28.324Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-17020 |
vulnerable | 2026-09-16 04:33:03.758956 |
Salon Booking System – Free Version <= 10.31.0 - Subscriber+ Arbitrary Booking PII Disclosure
The Salon Booking System WordPress plugin through 10.31.0 does not verify that a requested booking belongs to the caller on one of its REST API endpoints, requiring only a basic read capability, allowing any authenticated user (including a Subscriber or self-registered customer account) to disclose any customer's booking personal data such as name, email, phone number, address and private notes by enumerating booking identifiers.
Published: 2026-08-10T06:00:17.618Z
Updated: 2026-08-13T12:53:29.975Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-17022 |
vulnerable | 2026-09-16 04:33:03.276001 |
Salon Booking System – Free Version < 10.30.34 - Unauthenticated Booking Information Disclosure via Booking Wizard
The Salon Booking System WordPress plugin before 10.30.34 does not properly validate a booking's ownership token before loading it in its booking-wizard confirmation steps, allowing unauthenticated attackers to disclose other customers' booking records, including personal information, by supplying a sequential booking identifier.
Published: 2026-08-10T06:00:17.984Z
Updated: 2026-08-13T13:03:21.439Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-17023 |
vulnerable | 2026-09-16 04:33:02.677693 |
Salon Booking System – Free Version <= 10.30.33 - Unauthenticated Google Calendar Connection Hijack via OAuth Callback
The Salon Booking System WordPress plugin through 10.30.33 does not perform any capability check or validate an OAuth state value on its Google Calendar authorization callback, which is also hooked for unauthenticated users, allowing an unauthenticated attacker to overwrite the site's stored Google Calendar connection tokens with attacker-controlled ones and hijack the integration. Exploitation requires the site to have configured its own Google OAuth client for the calendar feature.
Published: 2026-08-10T06:00:18.178Z
Updated: 2026-08-11T20:55:17.873Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-11887 |
vulnerable | 2026-07-29 00:23:31.762856 |
Salon Booking System < 10.30.20 - Subscriber+ Booking Approval Bypass
The Salon Booking System WordPress plugin before 10.30.20 does not have proper authorisation checks on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to modify a Salon Booking System WordPress plugin before 10.30.20 setting and bypass the manual approval of new bookings.
Published: 2026-07-01T06:00:02.900Z
Updated: 2026-07-01T10:16:01.889Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-2603 |
vulnerable | 2026-06-08 06:33:31.627296 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-2439 |
vulnerable | 2026-06-08 06:33:31.115982 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-2429 |
vulnerable | 2026-06-08 06:33:31.088768 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-2102 |
vulnerable | 2026-06-08 06:33:30.343060 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-2101 |
vulnerable | 2026-06-08 06:33:30.340709 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-0920 |
vulnerable | 2026-06-08 05:39:11.494945 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-0919 |
vulnerable | 2026-06-08 05:39:11.492908 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.