Salonbookingsystem
Salonbookingsystem Salon Booking System: vulnerabilidades y CVE
Salonbookingsystem Salon Booking System tiene 38 vulnerabilidades publicadas, 14 de ellas en los últimos 12 meses. 5 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE38
Últimos 12 meses14
Críticas5
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-105070 | Alta (8.8) | 0.29% | — | 6 oct 2026 | Unauthenticated Privilege Escalation in Salon booking system <= 10.31.7 versions. |
| CVE-2026-81793 | Media (6.5) | 0.33% | — | 10 sept 2026 | Missing Authorization vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Salon booking system: from n/a… |
| CVE-2026-66453 | Crítica (9.8) | 0.61% | — | 13 ago 2026 | Unauthenticated Broken Authentication in Salon booking system <= 10.30.26 versions. |
| CVE-2026-17023 | Media (4.8) | 0.27% | — | 10 ago 2026 | The Salon Booking System WordPress plugin through 10.30.33 does not perform any capability check or validate an OAuth state value on its Google Calendar authorization callback, which is also hooked for unauthenticated… |
| CVE-2026-17022 | Alta (7.5) | 0.43% | — | 10 ago 2026 | The Salon Booking System WordPress plugin before 10.30.34 does not properly validate a booking's ownership token before loading it in its booking-wizard confirmation steps, allowing unauthenticated attackers to disclose… |
| CVE-2026-17021 | Media (5.3) | 0.30% | — | 10 ago 2026 | The Salon Booking System WordPress plugin before 10.30.34 does not properly restrict access to some of its booking-modification AJAX actions and does not verify ownership of the targeted booking, allowing… |
| CVE-2026-17020 | Media (4.3) | 0.27% | — | 10 ago 2026 | The Salon Booking System WordPress plugin through 10.31.0 does not verify that a requested booking belongs to the caller on one of its REST API endpoints, requiring only a basic read capability, allowing any… |
| CVE-2026-15070 | Alta (8.8) | 0.40% | — | 10 jul 2026 | The Salon Booking System – Free Version plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 10.30.32. This is due to missing or incorrect nonce validation on the… |
| CVE-2026-11887 | Media (4.3) | 0.28% | — | 1 jul 2026 | The Salon Booking System WordPress plugin before 10.30.20 does not have proper authorisation checks on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to modify a Salon Booking System… |
| CVE-2026-40768 | Alta (7.3) | 0.30% | — | 17 jun 2026 | Unauthenticated Insecure Direct Object References (IDOR) in Salon booking system <= 10.30.24 versions. |
| CVE-2026-42666 | Alta (7.5) | 0.39% | — | 15 jun 2026 | Unauthenticated Broken Access Control in Salon booking system <= 10.30.25 versions. |
| CVE-2026-6320 | Alta (7.5) | 0.55% | — | 2 may 2026 | The Salon Booking System – Free Version plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 10.30.25. This is due to the public booking flow accepting attacker-controlled… |
| CVE-2025-67954 | Media (6.5) | 0.41% | — | 22 ene 2026 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Retrieve Embedded Sensitive Data.This issue affects Salon… |
| CVE-2025-66531 | Media (4.3) | 0.16% | — | 9 dic 2025 | Cross-Site Request Forgery (CSRF) vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Cross Site Request Forgery.This issue affects Salon booking system: from n/a through <= 10.30.3. |
| CVE-2025-8492 | Media (5.3) | 0.29% | — | 11 sept 2025 | The Salon Booking System, Appointment Scheduling for Salons, Spas & Small Businesses plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax function in all… |
| CVE-2025-47583 | Media (5.4) | 0.14% | — | 19 may 2025 | Cross-Site Request Forgery (CSRF) vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Cross Site Request Forgery.This issue affects Salon booking system: from n/a through <= 10.16. |
| CVE-2024-9882 | Media (4.8) | 0.26% | — | 15 may 2025 | The Salon Booking System, Appointment Scheduling for Salons, Spas & Small Businesses WordPress plugin before 1.9.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin… |
| CVE-2025-32220 | Alta (8.8) | 0.52% | — | 4 abr 2025 | Missing Authorization vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Salon booking system: from n/a… |
| CVE-2025-31560 | Alta (7.2) | 0.56% | — | 1 abr 2025 | Incorrect Privilege Assignment vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Privilege Escalation.This issue affects Salon booking system: from n/a through < 10.15. |
| CVE-2024-47316 | Alta (8.8) | 0.33% | — | 5 oct 2024 | Authorization Bypass Through User-Controlled Key vulnerability in Dimitri Grassi Salon booking system salon-booking-system.This issue affects Salon booking system: from n/a through <= 10.9. |
| CVE-2024-39658 | Alta (7.2) | 0.44% | — | 29 ago 2024 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Salon Booking System Salon booking system allows SQL Injection.This issue affects Salon booking system: from n/a… |
| CVE-2024-43280 | Media (6.1) | 0.26% | — | 19 ago 2024 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Salon Booking System Salon booking system.This issue affects Salon booking system: from n/a through 10.8.1. |
| CVE-2024-37231 | Crítica (9.1) | 0.58% | — | 24 jun 2024 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Salon Booking System Salon booking system allows File Manipulation.This issue affects Salon booking system: from n/a… |
| CVE-2024-3229 | Crítica (9.8) | 0.85% | — | 19 jun 2024 | The Salon booking system plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the SLN_Action_Ajax_ImportAssistants function along with missing authorization checks in all… |
| CVE-2024-4468 | Media (5.4) | 0.39% | — | 8 jun 2024 | The Salon booking system plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on several functions hooked into admin_init in all versions up to, and… |
| CVE-2024-4442 | Crítica (9.1) | 1.2% | — | 21 may 2024 | The Salon booking system plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 9.8. This is due to the plugin not properly validating the path of an uploaded file prior to… |
| CVE-2023-48319 | Alta (7.2) | 0.52% | — | 17 may 2024 | Improper Privilege Management vulnerability in Salon Booking System Salon booking system allows Privilege Escalation.This issue affects Salon booking system: from n/a through 8.6. |
| CVE-2024-2603 | Media (6.3) | 0.46% | — | 26 abr 2024 | The Salon booking system WordPress plugin through 9.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin (or editor depending on Salon booking system WordPress… |
| CVE-2024-2439 | Media (4.8) | 0.42% | — | 26 abr 2024 | The Salon booking system WordPress plugin through 9.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as Editor to perform Stored Cross-Site Scripting attacks even when… |
| CVE-2024-2429 | Media (4.3) | 0.25% | — | 26 abr 2024 | The Salon booking system WordPress plugin through 9.6.5 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.