CVE-2023-33408
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
Minical version 1.0.0 is vulnerable to Cross Site Scripting (XSS) due to insufficient input validation in the application's user input handling in the security_helper.php file.
Risk Assessment
An attacker could exploit this vulnerability to inject malicious JavaScript code, potentially leading to user data theft or session hijacking.
Recommendation
It is recommended to improve input validation in the application and to update to the latest version if available.
Other vulnerabilities in Minical 1.0.0
See all- CVE-2023-3307Medium
A critical vulnerability was found in miniCal 1.0.0, affecting unknown processing of the file /booking/show_bookings/. Manipulation of the argument search_query leads to SQL injection.
- CVE-2023-33409Medium
Minical version 1.0.0 is vulnerable to Cross Site Request Forgery (CSRF) via minical/public/application/controllers/settings/company.php.
Original NVD description (English source)
Minical 1.0.0 is vulnerable to Cross Site Scripting (XSS). The vulnerability exists due to insufficient input validation in the application's user input handling in the security_helper.php file.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS