CVE-2022-0920

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The Salon booking system Free and Pro WordPress plugins before 7.6.3 do not have proper authorisation in some of its endpoints, which could allow customers to access all bookings and other customer's data

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-863

Affected software

VendorProductVersions
UnknownSalon booking system>= 7.6.3, < 7.6.3
UnknownSalon Booking System Pro>= 7.6.3, < 7.6.3

References

Timeline

Published
Apr 11, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-09216.7Abusing Backup/Restore feature to achieve Remote Code Execution in GitHub repository microweber/microweber prior to 1.2.12.CVE-2022-09226.5The software does not perform any authentication for critical system functionality.CVE-2022-09239.8Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in HandlerDialog_KID.ashCVE-2022-09245.5Out-of-bounds Read error in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that coCVE-2022-09264.8File upload filter bypass leading to stored XSS in GitHub repository microweber/microweber prior to 1.2.12.CVE-2022-09285.4Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.12.CVE-2022-09296.1XSS on dynamic_text module in GitHub repository microweber/microweber prior to 1.2.11.CVE-2022-09304.8File upload filter bypass leading to stored XSS in GitHub repository microweber/microweber prior to 1.2.12.CVE-2022-09326.5Missing Authorization in GitHub repository saleor/saleor prior to 3.1.2.CVE-2022-09347.5A single-byte, non-arbitrary write/use-after-free flaw was found in dnsmasq. This flaw allows an attacker who sends a crafted packet processCVE-2022-09358.8Host Header injection in password Reset in GitHub repository livehelperchat/livehelperchat prior to 3.97.CVE-2022-09365.4Cross-site Scripting (XSS) - Stored in GitHub repository autolab/autolab prior to 2.8.0.
CVE-2022-0920: High severity, CVSS 7.5 | Vulnix