alextselegidis/easyappointments vulnerable to Stored Cross-site Scripting

Impact

alextselegidis/easyappointments is vulnerable to stored cross-site scripting in versions 1.4.3 and prior. A patch is available at commit bddc5cbeb7ff237a72943b304dcb01c653781767 and anticipated to be part of version 1.5.0.

Affected packages

Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.

Original source description

References

• Security advisory nvd.nist.gov/vuln/detail/CVE-2023-2102
• Patch github.com/alextselegidis/easyappointments/commit/bddc5cbeb7ff237a72943b304dcb01c653781767
• Source reference github.com/alextselegidis/easyappointments
• Source reference huntr.dev/bounties/dd7c04a7-a984-4387-9ac4-24596e7ece44