User Enumeration Flaw in PHPJabbers Appointment Scheduler by Cydia

CVE-2023-36127

Summary

The PHPJabbers Appointment Scheduler version 3.0 is susceptible to a user enumeration vulnerability during the password recovery process. The application provides differing messages based on the validity of the username supplied, allowing attackers to discern whether a username exists in the system. This discrepancy could be exploited to conduct brute force attacks targeting valid user accounts, posing a significant risk to user credentials and overall security.

References