CVE-2026-66453

CriticalCVSS 9.8/10Last modified Aug 14, 2026

Description

Unauthenticated Broken Authentication in Salon booking system <= 10.30.26 versions.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-288

Affected software

VendorProductVersions
Dimitri GrassiSalon booking system<= 10.30.26

References

Timeline

Published
Aug 13, 2026
Last modified
Aug 14, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-664546.5Unauthenticated Broken Access Control in WP Social Avatar <= 1.5 versions.CVE-2026-664556.0Subscriber Broken Access Control in ReactPress <= 3.4.0 versions.CVE-2026-664566.5Subscriber Cross Site Scripting (XSS) in Profile Extra Fields by BestWebSoft <= 1.3.4 versions.CVE-2026-664577.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite Events Manager events-managerCVE-2026-664589.3Unauthenticated SQL Injection in RealPress <= 1.1.2 versions.CVE-2026-664596.5Unauthenticated Broken Access Control in AI for SEO <= 2.4.2 versions.CVE-2026-66466.4The The7 theme for WordPress is vulnerable to Stored Cross-Site Scripting via the 'dt_default_button' shortcode in all versions up to, and iCVE-2026-664606.5Subscriber Cross Site Scripting (XSS) in AfterShip Tracking <= 1.18.1 versions.CVE-2026-664617.5Unauthenticated Broken Access Control in SMEPay: UPI Gateway for WooCommerce <= 1.0.5 versions.CVE-2026-664627.5Unauthenticated Sensitive Data Exposure in WooCommerce Appointments <= 5.3.8 versions.CVE-2026-664637.5Unauthenticated Sensitive Data Exposure in iCARRY <= 2.9 versions.CVE-2026-664646.5Unauthenticated Broken Access Control in Internal Link Optimiser <= 5.2.7 versions.
CVE-2026-66453: Critical severity, CVSS 9.8 | Vulnix