Cross Site Scripting Vulnerability in Availability Booking Calendar by Plugin Vendor
CVE-2023-48208

6.1MEDIUM

Key Information:

Vendor

PHPjabbers

Status
Availability Booking Calendar
Vendor
CVE Published:
7 December 2023

What is CVE-2023-48208?

A Cross Site Scripting vulnerability has been identified in Availability Booking Calendar 5.0. It allows attackers to inject malicious JavaScript through multiple parameters such as name, plugin_sms_api_key, plugin_sms_country_code, uuid, title, or country name in index.php. This flaw can lead to unauthorized access and potential data breaches for users of this plugin.

References

http://packetstormsecurity.com/files/175805

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.