Administrator-context script execution via unsanitized booking fields

Stored XSS in Salon Booking System before 9.6.3 allows remote attackers to run script in an administrator's browser via a booking. The booking flow stores the Mobile Phone field and sln[sms_prefix] parameter without adequate sanitization or output escaping before the Bookings list renders them. No account is required to submit a booking, but execution requires an administrator to open the Bookings page and interact with the injected entry; the demonstrated impact is script execution in that administrator context.