CVE-2026-110013

The Salon Booking System WordPress plugin before 10.31.9 does not generate its booking-API access tokens from a secure random source, instead deriving them from a value hardcoded in the Salon Booking System WordPress plugin before 10.31.9 and the second at which a token was issued. An attacker ab...

CVE-2026-110013

The Salon Booking System WordPress plugin before version 10.31.9 is vulnerable to unauthenticated Salon REST API access due to predictable access tokens. The root cause is that the plugin fails to use a secure random source, instead deriving tokens from a hardcoded value and the timestamp (second...

EUVD-2026-102692

The Salon Booking System WordPress plugin before 10.31.9 does not generate its booking-API access tokens from a secure random source, instead deriving them from a value hardcoded in the Salon Booking System WordPress plugin before 10.31.9 and the second at which a token was issued. An attacker ab...

PT-2026-115472

Name of the Vulnerable Software and Affected Versions Salon Booking System WordPress plugin versions prior to 10.31.9 Description The plugin fails to generate booking-API access tokens using a secure random source. Instead, tokens are derived from a hardcoded value and the specific second the tok...

CVE-2026-110013: Improper Authentication

The Salon Booking System WordPress plugin before 10.31.9 does not generate its booking-API access tokens from a secure random source, instead deriving them from a value hardcoded in the Salon Booking System WordPress plugin before 10.31.9 and the second at which a token was issued. An attacker ab...

EUVD-2026-25299

A vulnerability in SpiceJet’s booking API allows unauthenticated users to query passenger name records PNRs without any access controls. Because PNR identifiers follow a predictable pattern, an attacker could systematically enumerate valid records and obtain associated passenger names. This flaw...

CVE-2026-6375

A vulnerability in SpiceJet’s booking API allows unauthenticated users to query passenger name records PNRs without any access controls. Because PNR identifiers follow a predictable pattern, an attacker could systematically enumerate valid records and obtain associated passenger names. This flaw...

CVE-2026-6375: Authorization Bypass Through User-Controlled Key

A vulnerability in SpiceJet’s booking API allows unauthenticated users to query passenger name records PNRs without any access controls. Because PNR identifiers follow a predictable pattern, an attacker could systematically enumerate valid records and obtain associated passenger names. This flaw...

PT-2026-34749

Name of the Vulnerable Software and Affected Versions SpiceJet booking API affected versions not specified Description A flaw in the booking API allows unauthenticated users to query passenger name records PNRs due to a lack of access controls. Since PNR identifiers follow a predictable pattern, ...

CVE-2025-53373

Natours is a Tour Booking API. The attacker can easily take over any victim account by injecting an attacker-controlled server domain in the Host header when requesting the /forgetpassword endpoint. This vulnerability is fixed with commit 7401793a8d9ed0f0c250c4e0ee2815d685d7a70b...

CVE-2025-53373 Natours has a 1 Click Account take over on reset password via Host Header injection

Natours is a Tour Booking API. The attacker can easily take over any victim account by injecting an attacker-controlled server domain in the Host header when requesting the /forgetpassword endpoint. This vulnerability is fixed with commit 7401793a8d9ed0f0c250c4e0ee2815d685d7a70b...