5.4
Moyenne
CVE-2023-3427 The Salon Booking System plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and…
Description
The Salon Booking System plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.4.6. This is due to missing or incorrect nonce validation on the 'save_customer' function. This makes it possible for unauthenticated attackers to change the admin role to customer or change the user meta to arbitrary values via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Salon Booking System 8.4 | premières → 8.4.7 | Pas de correctif indiqué |
| Salon Booking System – Free Version 8.4 | premières → 8.4.7 | Pas de correctif indiqué |
Autres CVE de Salon Booking System
Les 5 CVE de Salon Booking System →
CVE-2022-4974
The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request…
6.3
Moyenne
CVE-2024-3229
The Salon booking system plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type…
9.8
Critique
CVE-2024-4468
The Salon booking system plugin for WordPress is vulnerable to unauthorized access and modification of data due to a…
4.3
Moyenne
CVE-2024-4442
The Salon booking system plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and…
9.1
Critique