Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Salon booking system 9.6.3 Clear all filters
TI-2024-01953 CVE-2024-2102 · GHSA-pjpc-v23w-hch2

Salon booking system < 9.6.3 - Unauthenticated Stored XSS

Priority MEDIUM 55

The Salon booking system WordPress plugin before 9.6.3 does not properly sanitize and escape the 'Mobile Phone' field and 'sms_prefix' parameter when booking an appointment, allowing customers to conduct Stored Cross-Sit…

CVSS 3.1MEDIUM 4.7 Network No auth User interaction EPSS 0.00464 Published 2024-04-17 Fixed in 9.6.3 CWE-79
TI-2024-01952 CVE-2024-2101 · GHSA-4xpx-694q-f2wv

WordPress Plugin Salon Booking System < 9.6.3 - Unauthenticated Stored Cross-Site Scripting (XSS)

Priority MEDIUM 59

The Salon booking system WordPress plugin before 9.6.3 does not properly sanitize and escape the 'Mobile Phone' field when booking an appointment, allowing customers to conduct Stored Cross-Site Scripting attacks.

CVSS 3.1MEDIUM 5.7 Network Low privileges User interaction EPSS 0.00631 Published 2024-04-17 Fixed in 9.6.3 CWE-79