https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 12:42:06 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-351905 EUVD-2026-351905 https://cve.radiocsirt.org/vuln/euvd-2026-351905 https://cve.radiocsirt.org/vuln/fkie_cve-2026-17020 <p>The Salon Booking System WordPress plugin through 10.31.0 does not verify that a requested booking belongs to the caller on one of its REST API endpoints, requiring only a basic read capability, allowing any authenticated user (including a Subscriber or self-registered customer account) to disclose any customer&#39;s booking personal data such as name, email, phone number, address and private notes by enumerating booking identifiers.</p> <p>The Salon Booking System WordPress plugin through 10.31.0 does not verify that a requested booking belongs to the caller on one of its REST API endpoints, requiring only a basic read capability, allowing any authenticated user (including a Subscriber or self-registered customer account) to disclose any customer&#39;s booking personal data such as name, email, phone number, address and private notes by enumerating booking identifiers.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-17020 https://cve.radiocsirt.org/vuln/ghsa-pf8j-pw7h-gqgp <p>The Salon Booking System WordPress plugin through 10.30.33 does not verify that a requested booking belongs to the caller on one of its REST API endpoints, requiring only a basic read capability, allowing any authenticated user (including a Subscriber or self-registered customer account) to disclose any customer&#39;s booking personal data such as name, email, phone number, address and private notes by enumerating booking identifiers.</p> <p>The Salon Booking System WordPress plugin through 10.30.33 does not verify that a requested booking belongs to the caller on one of its REST API endpoints, requiring only a basic read capability, allowing any authenticated user (including a Subscriber or self-registered customer account) to disclose any customer&#39;s booking personal data such as name, email, phone number, address and private notes by enumerating booking identifiers.</p> https://cve.radiocsirt.org/vuln/ghsa-pf8j-pw7h-gqgp