CVE-2022-30706

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Open redirect vulnerability in Booked versions prior to 3.3 allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having a user to access a specially crafted URL.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-601

Affected software

Vendor	Product	Versions
Twinkle Toes Software	Booked	versions prior to 3.3

References

https://jvn.jp/en/jp/JVN75063798/Third Party Advisory
https://www.bookedscheduler.com/Vendor Advisory
https://jvn.jp/en/jp/JVN75063798/Third Party Advisory
https://www.bookedscheduler.com/Vendor Advisory

Timeline

Published: Jul 26, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-307078.8Violation of secure design principles exists in the communication of CAMS for HIS. Affected products and versions are CENTUM series where LH CVE-2022-307088.8Webmin through 1.991, when the Authentic theme is used, allows remote code execution when a user has been manually created (i.e., not create CVE-2022-307095.3Improper input validation check logic vulnerability in SECRIL prior to SMR Jun-2022 Release 1 allows attackers to trigger crash.CVE-2022-30718.8Use after free in Tab Strip in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a remote attacker who convinced a user to e CVE-2022-307109.1Improper validation vulnerability in RemoteViews prior to SMR Jun-2022 Release 1 allows attackers to launch certain activities.CVE-2022-307119.1Improper validation vulnerability in FeedsInfo prior to SMR Jun-2022 Release 1 allows attackers to launch certain activities.CVE-2022-307129.1Improper validation vulnerability in KfaOptions prior to SMR Jun-2022 Release 1 allows attackers to launch certain activities.CVE-2022-307139.1Improper validation vulnerability in LSOItemData prior to SMR Jun-2022 Release 1 allows attackers to launch certain activities.CVE-2022-307143.3Information exposure vulnerability in SemIWCMonitor prior to SMR Jun-2022 Release 1 allows local attackers to get MAC address information.CVE-2022-307155.3Improper access control vulnerability in DofViewer prior to SMR Jun-2022 Release 1 allows attackers to control floating system alert window.CVE-2022-307165.3Unprotected broadcast in sendIntentForToastDumpLog in DisplayToast prior to SMR Jun-2022 Release 1 allows untrusted applications to access t CVE-2022-307177.5Improper caller check in AR Emoji prior to SMR Jun-2022 Release 1 allows untrusted applications to use some camera functions via deeplink.