CVE-2026-110014: falha de média gravidade em Salon Booking System
Salon Booking System < 10.31.9 - Unauthenticated Booking Creation with Arbitrary Customer ID and Status
Publicada em
33Vexday Risk Score
Sem sinal de exploração. Ela tem prova de conceito pública.
ssvc Attendcvss 5.3epss 0.2%
probabilidade de exploração
0.2%top 88% das CVEs
exploração observada
nãonenhuma fonte reporta
1 exploit(s) público(s)
The Salon Booking System WordPress plugin before 10.31.9 does not properly check authorization before creating a booking and trusts a caller-supplied user identifier and booking status, allowing unauthenticated attackers to create bookings attributed to arbitrary users, overwrite those users' stored contact details, and mark bookings as paid or confirmed without any payment.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Produtos afetados
Unknown · Salon Booking SystemPoCs públicas encontradas — 1
cve_referencewpscan.com/vulnerability/91598659-022c-4e04-ad16-399e11081053/não verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — Salon Booking System
No mesmo produto, das mais perigosas para as menos.
CVE-2026-17022HIGHSalon Booking System – Free Version < 10.30.34 - Unauthenticated Booking Information Disclosure via Booking WizardEPSS 0.4%CVE-2026-17021MEDIUMSalon Booking System – Free Version < 10.30.34 - Unauthenticated Arbitrary Booking Total TamperingEPSS 0.3%CVE-2026-11887MEDIUMSalon Booking System < 10.30.20 - Subscriber+ Booking Approval BypassEPSS 0.3%CVE-2026-17023MEDIUMSalon Booking System – Free Version <= 10.30.33 - Unauthenticated Google Calendar Connection Hijack via OAuth CallbackEPSS 0.3%CVE-2026-17020MEDIUMSalon Booking System – Free Version <= 10.31.0 - Subscriber+ Arbitrary Booking PII DisclosureEPSS 0.3%CVE-2026-110031HIGHSalon Booking System 10.17 - 10.31.10 - Salon Staff+ Privilege Escalation to Administrator via Case-Insensitive User Meta KeyEPSS 0.3%