CVE-2025-67954

CVE-2025-67954 describes an information disclosure flaw in the WordPress plugin “Salon Booking System” (Salon booking system) affecting versions up to and including 10.30.3. The issue is exposed via an unauthorized control sphere, enabling retrieval of embedded sensitive data. Multiple security s...

PT-2026-4261

Missing Authorization vulnerability in bookingalgorithms BA Book Everything ba-book-everything allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BA Book Everything: from n/a through = 1.8.16...

WordPress plugin: Salon booking system has a security vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. The...

PT-2026-4034

Name of the Vulnerable Software and Affected Versions Dimitri Grassi Salon booking system versions prior to and including 10.30.3 Description The Salon booking system contains a flaw that allows the retrieval of embedded sensitive data, potentially exposing system information to unauthorized...

WordPress Salon booking system plugin <= 10.30.3 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by daroo in WordPress Plugin Salon booking system versions = 10.30.3...

CVE-2022-31342

Online Car Wash Booking System v1.0 is vulnerable to Delete any file via /ocwbs/classes/Master.php?f=deleteimg...

CVE-2022-31351

Online Car Wash Booking System v1.0 by oretnom23 has SQL injection via /ocwbs/admin/services/manageprice.php?id=...

CVE-2022-31353

Online Car Wash Booking System v1.0 is vulnerable to SQL Injection via /ocwbs/admin/services/viewservice.php?id=...

CVE-2022-31344

Online Car Wash Booking System v1.0 is vulnerable to SQL Injection via /ocwbs/classes/Master.php?f=deletebooking...

CVE-2022-31348

Online Car Wash Booking System v1.0 is vulnerable to SQL Injection via /ocwbs/admin/bookings/updatestatus.php?id=...

CVE-2022-31350

Online Car Wash Booking System v1.0 is vulnerable to SQL Injection via /ocwbs/admin/vehicles/managevehicle.php?id=...

CVE-2022-0919

The Salon booking system Free and pro WordPress plugins before 7.6.3 do not have proper authorisation when searching bookings, allowing any unauthenticated users to search other's booking, as well as retrieve sensitive information about the bookings, such as the full name, email and phone number ...

CVE-2020-23984

Online Hotel Booking System Pro PHP Version 1.3 has Persistent Cross-site Scripting in Customer registration-form all-tags...

CVE-2023-25062

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in PINPOINT.WORLD Pinpoint Booking System plugin = 2.9.9.2.8 versions...

CVE-2023-45270

Cross-Site Request Forgery CSRF vulnerability in PINPOINT.WORLD Pinpoint Booking System plugin = 2.9.9.4.0 versions...

CVE-2024-2720

A vulnerability classified as problematic was found in Campcodes Complete Online DJ Booking System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/aboutus.php. The manipulation of the argument pagetitle leads to cross site scripting. The attack can be launched...

CVE-2024-2603

The Salon booking system WordPress plugin through 9.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin or editor depending on Salon booking system WordPress plugin through 9.6.5 configuration to perform Stored Cross-Site Scripting attacks...

CVE-2024-2102

The Salon booking system WordPress plugin before 9.6.3 does not properly sanitize and escape the 'Mobile Phone' field and 'smsprefix' parameter when booking an appointment, allowing customers to conduct Stored Cross-Site Scripting attacks. The payload gets triggered when an admin visits the...

CVE-2024-2429

The Salon booking system WordPress plugin through 9.6.5 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-2717

A vulnerability was found in Campcodes Complete Online DJ Booking System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/booking-search.php. The manipulation of the argument searchdata leads to cross site scripting. The attack can be initiated...