CVE-2019-11488

Incorrect Access Control in the Account Access / Password Reset Link in SimplyBook.me Enterprise before 2019-04-23 allows Unauthorized Attackers to READ/WRITE Customer or Administrator data via a persistent HTTP GET Request Hash Link Replay, as demonstrated by a login-link from the browser history.

• CWE-287

• https://blog.cybrgrade.com/CVE-2019-11488-SimplyBook.me-hash-replay-attack/Exploit, Third Party Advisory
• https://cybrgrade.com/files/Report_SimplyBookIt_MD5_Hash_Replay_by_CybrGradeUKLtd.pdfExploit, Technical Description, Third Party Advisory
• https://blog.cybrgrade.com/CVE-2019-11488-SimplyBook.me-hash-replay-attack/Exploit, Third Party Advisory
• https://cybrgrade.com/files/Report_SimplyBookIt_MD5_Hash_Replay_by_CybrGradeUKLtd.pdfExploit, Technical Description, Third Party Advisory

Published

Apr 25, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-11482Sander Bos discovered a time of check to time of use (TOCTTO…4.7
• CVE-2019-11483Sander Bos discovered Apport mishandled crash dumps originat…3.3
• CVE-2019-11484Kevin Backhouse discovered an integer overflow in bson_ensur…7.8
• CVE-2019-11485Sander Bos discovered Apport's lock file was in a world-writ…3.3
• CVE-2019-11486The Siemens R3964 line discipline driver in drivers/tty/n_r3…7
• CVE-2019-11487The Linux kernel before 5.1-rc5 allows page->_refcount refer…7.8
• CVE-2019-11489Incorrect Access Control in the Administrative Management In…
• CVE-2019-1149A remote code execution vulnerability exists when the Window…8.8
• CVE-2019-11490An issue was discovered in Npcap 0.992. Sending a malformed …
• CVE-2019-11492ProjectSend before r1070 writes user passwords to the server…
• CVE-2019-11493VeryPDF 4.1 has a Memory Overflow leading to Code Execution …
• CVE-2019-11494In the IMAP Server in Dovecot 2.3.3 through 2.3.5.2, the sub…7.5