PHPJabbers

Records140All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical30CVSS 9.0–10.0

CVSS high29CVSS 7.0–8.9

Exploited now

PHPJabbers records in CISA KEV

No PHPJabbers vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Cleaning Business Software 9 records HIGH Time Slots Booking Calendar 9 records HIGH Appointment Scheduler 8 records HIGH Availability Booking Calendar 8 records HIGH Cinema Booking System 8 records HIGH Event Booking Calendar 7 records HIGH Fundraising Script 7 records HIGH Car Rental Script 6 records HIGH

Records

8 records in Appointment Scheduler · all components

TI-2023-26656 CVE-2023-48841 · GHSA-jv7h-2pm2-q7mr

Appointment Scheduler 3.0 is vulnerable to CSV Injection via a Language > Labels > Export action.

HIGH 73

Appointment Scheduler 3.0 is vulnerable to CSV Injection via a Language > Labels > Export action.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01221 Published 2023-12-07 No fix listed CWE-74

TI-2023-18124 CVE-2023-36126 · GHSA-4mrp-jwjf-x8vh

There is a Cross Site Scripting (XSS) vulnerability in the "theme" parameter of…

MEDIUM 60

There is a Cross Site Scripting (XSS) vulnerability in the "theme" parameter of preview.php in PHPJabbers Appointment Scheduler v3.0

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00433 Published 2023-10-10 No fix listed CWE-79

TI-2023-18125 CVE-2023-36127 · GHSA-j2w9-9v56-q925

User enumeration is found in in PHPJabbers Appointment Scheduler 3.0.

MEDIUM 40

User enumeration is found in in PHPJabbers Appointment Scheduler 3.0.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00709 Published 2023-10-10 No fix listed CWE-203

TI-2023-26655 CVE-2023-48840 · GHSA-jgw7-p4wj-h882

A lack of rate limiting in pjActionAjaxSend in Appointment Scheduler 3.0 allows attackers to cause resource exhaustion.

LOW 35

A lack of rate limiting in pjActionAjaxSend in Appointment Scheduler 3.0 allows attackers to cause resource exhaustion.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01051 Published 2023-12-07 No fix listed CWE-400

TI-2014-08163 CVE-2014-10001 · GHSA-43wv-9mh2-86p7

Multiple cross-site request forgery (CSRF) vulnerabilities in PHPJabbers Appointment…

LOW 34

Multiple cross-site request forgery (CSRF) vulnerabilities in PHPJabbers Appointment Scheduler 2.0 allow remote attackers to hijack the authentication of administrators for requests that (1) conduct cross-site scripting…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.02264 Published 2015-01-13 No fix listed CWE-352

TI-2014-08172 CVE-2014-10010 · GHSA-3x89-96hq-8v55

Directory traversal vulnerability in PHPJabbers Appointment Scheduler 2.0 allows remote…

LOW 33

Directory traversal vulnerability in PHPJabbers Appointment Scheduler 2.0 allows remote attackers to read arbitrary files via a ..

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.07651 Published 2015-01-13 No fix listed CWE-22

TI-2023-26654 CVE-2023-48839 · GHSA-6459-3p48-6v4x

Appointment Scheduler 3.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS)…

LOW 25

Appointment Scheduler 3.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) issues via the name, plugin_sms_api_key, plugin_sms_country_code, calendar_id, title, country name, or customer_name parameter.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00419 Published 2023-12-07 No fix listed CWE-79

TI-2023-26653 CVE-2023-48838 · GHSA-wq2x-683r-v6q3

Appointment Scheduler 3.0 is vulnerable to Multiple HTML Injection issues via the SMS API Key or Default Country Code.

LOW 25

Appointment Scheduler 3.0 is vulnerable to Multiple HTML Injection issues via the SMS API Key or Default Country Code.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00465 Published 2023-12-07 No fix listed CWE-79

Open these records in search →