CVE-2026-37431
CriticalSummary
Beauty Parlour Management System v1.1 was found to have a SQL injection vulnerability via the aptnumber parameter in the /appointment-detail.php endpoint. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement.
Risk Assessment
This vulnerability could lead to the exposure of confidential data, posing a serious threat to the security of the organization and its clients.
Recommendation
It is recommended to immediately update the system to the latest version and implement appropriate security measures to prevent SQL injections.
Other vulnerabilities in Beauty Parlour Management System v1.1
See all- CVE-2024-53480Critical
A SQL injection vulnerability was found in Phpgurukul's Beauty Parlour Management System v1.1 in `login.php` via the `emailcont` parameter. An attacker can manipulate this parameter to execute unauthorized database queries.
- CVE-2024-51065Critical
A SQL injection vulnerability was found in Phpgurukul Beauty Parlour Management System v1.1 in admin/index.php via the username parameter. An attacker can send a malicious SQL query, leading to unauthorized database access.
- CVE-2024-51066High
An IDOR vulnerability in appointment-detail.php in Beauty Parlour Management System v1.1 allows unauthorized access to other customers' Personally Identifiable Information (PII).
Original NVD description (English source)
Beauty Parlour Management System v1.1 was discovered to contain a SQL injection vulnerability via the aptnumber parameter in the /appointment-detail.php endpoint. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS