Vulnerabilities

TI-2023-25025 CVE-2023-46478 · GHSA-r4xh-hp7q-826q

An issue in minCal v.1.0.0 allows a remote attacker to execute arbitrary code via a…

HIGH 73

An issue in minCal v.1.0.0 allows a remote attacker to execute arbitrary code via a crafted script to the customer_data parameter.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0115 Published 2023-10-30 No fix listed CWE-639

TI-2023-03094 CVE-2023-3307 · GHSA-w4x6-wxp7-96xh

MEDIUM 40

A vulnerability was found in miniCal 1.0.0.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00871 Published 2023-06-18 No fix listed CWE-89

TI-2023-16527 CVE-2023-33410 · GHSA-j569-f347-3cgf

MEDIUM 42

Minical 1.0.0 and earlier contains a CSV injection vulnerability which allows an attacker to execute remote code.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01163 Published 2023-06-05 No fix listed CWE-1236

TI-2023-16526 CVE-2023-33409 · GHSA-m933-gwp2-8x2h

MEDIUM 62

Minical 1.0.0 is vulnerable to Cross Site Request Forgery (CSRF) via minical/public/application/controllers/settings/company.php.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00394 Published 2023-06-05 No fix listed CWE-352

TI-2023-16525 CVE-2023-33408 · GHSA-5qpm-vrqv-qcrv

MEDIUM 58

Minical 1.0.0 is vulnerable to Cross Site Scripting (XSS).

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00548 Published 2023-06-05 No fix listed CWE-79