CVE-2023-2102

MEDIUM6.8EPSS 0.36%

alextselegidis/easyappointments vulnerable to Stored Cross-site Scripting

Published: 4/15/2023Modified: 11/8/2023

Description

alextselegidis/easyappointments is vulnerable to stored cross-site scripting in versions 1.4.3 and prior. A patch is available at commit bddc5cbeb7ff237a72943b304dcb01c653781767 and anticipated to be part of version 1.5.0.

Affected packages (1)

Packagist/alextselegidis/easyappointmentsfrom 0, <= 1.4.3

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	MEDIUM6.8	CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:H

References (4)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2023-2102
PATCHhttps://github.com/alextselegidis/easyappointments
WEBhttps://github.com/alextselegidis/easyappointments/commit/bddc5cbeb7ff237a72943b304dcb01c653781767
WEBhttps://huntr.dev/bounties/dd7c04a7-a984-4387-9ac4-24596e7ece44