CVE-2023-2105 Session Fixation in alextselegidis/easyappointments

Session Fixation in GitHub repository alextselegidis/easyappointments prior to 1.5.0...

PT-2023-17820 · Unknown · Easyappointments

Name of the Vulnerable Software and Affected Versions: alextselegidis/easyappointments versions prior to 1.5.0 Description: The issue is related to stored Cross-site Scripting XSS in the GitHub repository alextselegidis/easyappointments. A patch is available, and it is anticipated to be part of...

PT-2023-17810 · Alextselegidis · Easyappointments

Name of the Vulnerable Software and Affected Versions: alextselegidis/easyappointments versions prior to 1.5.0 Description: The issue is related to stored Cross-site Scripting XSS in the GitHub repository alextselegidis/easyappointments. This type of attack occurs when an application stores user...

CVE-2023-2104 Improper Access Control in alextselegidis/easyappointments

Improper Access Control in GitHub repository alextselegidis/easyappointments prior to 1.5.0...

CVE-2023-2105

CVE-2023-2105 concerns the Easy!Appointments project by alextselegidis. The issue is a session fixation vulnerability where the application does not generate a new ea_session cookie after user authentication, allowing a malicious actor to inject a session cookie and gain access after login. The f...

Session Fixation

Session Fixation in GitHub repository alextselegidis/easyappointments prior to 1.5.0...

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Cross-site Scripting XSS - Stored in GitHub repository alextselegidis/easyappointments prior to 1.5.0...

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Cross-site Scripting XSS - Stored in GitHub repository alextselegidis/easyappointments prior to 1.5.0...

Improper Access Control

Improper Access Control in GitHub repository alextselegidis/easyappointments prior to 1.5.0...

CVE-2023-2102 Cross-site Scripting (XSS) - Stored in alextselegidis/easyappointments

Cross-site Scripting XSS - Stored in GitHub repository alextselegidis/easyappointments prior to 1.5.0...

Stored HTML Injection

alextselegidis/easyappointments is vulnerable to Stored HTML Injection. The vulnerability is due to improper sanitization in the compony name field, which allows an attacker to inject and execute malicious code into the system...

Session Fixation Vulnerability

Description It was noticed that the easyappointments application is vulnerable to Session Fixation vulnerability. The application does not generate a new easession cookie after the user authenticate successfully into the application. A malicious user is able to create a new session cookie value a...

GHSA-9QVW-FHJ2-XQMV Code Injection in alextselegidis/easyappointments

Code Injection in GitHub repository alextselegidis/easyappointments prior to 1.5.0 due to unescaped output...

Code Injection in alextselegidis/easyappointments

Code Injection in GitHub repository alextselegidis/easyappointments prior to 1.5.0 due to unescaped output...

CVE-2023-1367

Code Injection in GitHub repository alextselegidis/easyappointments prior to 1.5.0...

CVE-2023-1367 Code Injection in alextselegidis/easyappointments

Code Injection in GitHub repository alextselegidis/easyappointments prior to 1.5.0...

PT-2023-16934 · Unknown · Easyappointments

Name of the Vulnerable Software and Affected Versions: easyappointments versions prior to 1.5.0 Description: The issue is related to code injection in the GitHub repository alextselegidis/easyappointments due to unescaped output. This allows for potential code injection attacks. Recommendations:...

CVE-2023-1367

CVE-2023-1367 — Code Injection in easyappointments (GitHub: alextselegidis/easyappointments) Concrete details in connected documents confirm a vulnerability in Easy!Appointments versions prior to 1.5.0 caused by unescaped output, enabling code injection. Public sources note an HTML injection vect...

CVE-2023-1367 Code Injection in alextselegidis/easyappointments

Code Injection in GitHub repository alextselegidis/easyappointments prior to 1.5.0...

Stored HTML Injection via Company Name

Description easyappointments present an html injection vulnerability on the company name field on "/index.php/backend/settings" page. Steps: 1. login as admin 2. go to /index.php/backend/settings Page 3. insert the payload in Company Name field 4. go back to the home page and see the result. Proo...