CVE-2022-0920: fallo en Salon booking system
Salon booking system < 7.6.3 - Customer+ Bookings/Customers Data Disclosure
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
3Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackepss 1.5%
The Salon booking system Free and Pro WordPress plugins before 7.6.3 do not have proper authorisation in some of its endpoints, which could allow customers to access all bookings and other customer's data
CVEs relacionadas — Salon booking system
En el mismo producto, de las más peligrosas a las menos.
CVE-2022-0919—Salon booking system < 7.6.3 - Unauthenticated Sensitive Data DisclosureEPSS 1.2%CVE-2024-2101MEDIUMWordPress Plugin Salon Booking System < 9.6.3 - Unauthenticated Stored Cross-Site Scripting (XSS)EPSS 0.6%CVE-2024-2603MEDIUMSalon booking system <= 9.6.5 - Editor+ Stored XSS via Email SettingsEPSS 0.5%CVE-2024-2102MEDIUMSalon booking system < 9.6.3 - Unauthenticated Stored XSSEPSS 0.5%CVE-2024-2439MEDIUMSalon booking system <= 9.6.5 - Editor+ Stored XSSEPSS 0.4%CVE-2024-2429MEDIUMSalon booking system <= 9.6.5 - Settings Update via CSRFEPSS 0.2%