GHSA-7m8r-gmc3-3p4v

alextselegidis/easyappointments vulnerable to Stored Cross-site Scripting

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-2103

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	alextselegidis/easyappointments	<= 1.4.3	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

alextselegidis/easyappointments is vulnerable to stored cross-site scripting in versions 1.4.3 and prior. A patch is available at commit 46a865300e94c7031cc0e315d95d3e3e56768498 and anticipated to be part of version 1.5.0.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-2103 advisory
https://github.com/alextselegidis/easyappointments/commit/46a865300e94c7031cc0e315d95d3e3e56768498 web
https://github.com/alextselegidis/easyappointments package
https://huntr.dev/bounties/1df09505-9923-43b9-82ef-15d94bc3f9dc web