CVE-2022-0919

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The Salon booking system Free and pro WordPress plugins before 7.6.3 do not have proper authorisation when searching bookings, allowing any unauthenticated users to search other's booking, as well as retrieve sensitive information about the bookings, such as the full name, email and phone number of the person who booked it.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
Unknown	Salon booking system	>= 7.6.3, < 7.6.3
Unknown	Salon Booking System Pro	>= 7.6.3, < 7.6.3

References

https://wpscan.com/vulnerability/e8f32e0b-4a89-460b-bb78-7c83ef5e16b4Exploit, Third Party Advisory
https://wpscan.com/vulnerability/e8f32e0b-4a89-460b-bb78-7c83ef5e16b4Exploit, Third Party Advisory

Timeline

Published: Apr 11, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-09207.5The Salon booking system Free and Pro WordPress plugins before 7.6.3 do not have proper authorisation in some of its endpoints, which could CVE-2022-09216.7Abusing Backup/Restore feature to achieve Remote Code Execution in GitHub repository microweber/microweber prior to 1.2.12.CVE-2022-09226.5The software does not perform any authentication for critical system functionality.CVE-2022-09239.8Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in HandlerDialog_KID.ash CVE-2022-09245.5Out-of-bounds Read error in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that co CVE-2022-09264.8File upload filter bypass leading to stored XSS in GitHub repository microweber/microweber prior to 1.2.12.CVE-2022-09285.4Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.12.CVE-2022-09296.1XSS on dynamic_text module in GitHub repository microweber/microweber prior to 1.2.11.CVE-2022-09304.8File upload filter bypass leading to stored XSS in GitHub repository microweber/microweber prior to 1.2.12.CVE-2022-09326.5Missing Authorization in GitHub repository saleor/saleor prior to 3.1.2.CVE-2022-09347.5A single-byte, non-arbitrary write/use-after-free flaw was found in dnsmasq. This flaw allows an attacker who sends a crafted packet process CVE-2022-09358.8Host Header injection in password Reset in GitHub repository livehelperchat/livehelperchat prior to 3.97.