CVE-2023-33563

HighCVSS 8.8

Published: 01/08/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.56%

42th percentile - higher than 42% of all known CVEs

Summary

In PHP Jabbers Time Slots Booking Calendar version 3.3, lack of verification when changing an email address and/or password on the Profile Page allows remote attackers to take over accounts.

Risk Assessment

Account takeover by an attacker may lead to unauthorized access to user data and actions within the system.

Recommendation

It is recommended to implement identity verification mechanisms when changing email addresses and passwords to secure user accounts.

Other vulnerabilities in PHP Jabbers Time Slots Booking Calendar

CVE-2023-33562Critical
User enumeration is found in PHP Jabbers Time Slots Booking Calendar v3.3. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.

Original NVD description (English source)

In PHP Jabbers Time Slots Booking Calendar 3.3 , lack of verification when changing an email address and/or password (on the Profile Page) allows remote attackers to take over accounts.