Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: Salon Booking System 10.31.9 Clear all filters
TI-2026-75274 CVE-2026-110015 · GHSA-p4gq-j2hf-4fr5

Cross-site request forgery in Salon Booking System allows admin account creation

Priority LOW 39

The Salon Booking System WordPress plugin before 10.31.9 does not correctly verify the authenticity of REST API requests and discards WordPress core's nonce check for cookie-authenticated sessions across the whole REST A…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00135 Published 2026-10-16 Fixed in 10.31.9 CWE-352
TI-2026-75273 CVE-2026-110014 · GHSA-p2vr-36g9-99rc

Missing authorization in Salon Booking System lets attackers create bookings

Priority LOW 29

The Salon Booking System WordPress plugin before 10.31.9 does not properly check authorization before creating a booking and trusts a caller-supplied user identifier and booking status, allowing unauthenticated attackers…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00221 Published 2026-10-16 Fixed in 10.31.9 CWE-862
TI-2026-75272 CVE-2026-110013 · GHSA-xqfx-qcxr-5fjm

Predictable access tokens in Salon Booking System expose booking API

Priority LOW 21

The Salon Booking System WordPress plugin before 10.31.9 does not generate its booking-API access tokens from a secure random source, instead deriving them from a value hardcoded in the Salon Booking System WordPress plu…

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.00163 Published 2026-10-16 Fixed in 10.31.9 CWE-287