GHSA-j6qq-9939-9jv8

alextselegidis/easyappointments vulnerable to Stored Cross-site Scripting

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-2102

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	alextselegidis/easyappointments	<= 1.4.3	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

alextselegidis/easyappointments is vulnerable to stored cross-site scripting in versions 1.4.3 and prior. A patch is available at commit bddc5cbeb7ff237a72943b304dcb01c653781767 and anticipated to be part of version 1.5.0.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-2102 advisory
https://github.com/alextselegidis/easyappointments/commit/bddc5cbeb7ff237a72943b304dcb01c653781767 web
https://github.com/alextselegidis/easyappointments package
https://huntr.dev/bounties/dd7c04a7-a984-4387-9ac4-24596e7ece44 web