CVE-2023-3544
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk26th percentile — higher than 26% of all known CVEs
Summary
A vulnerability was found in GZ Scripts Time Slot Booking Calendar PHP version 1.8, allowing cross-site scripting (XSS) attacks through manipulation of the arguments first_name, second_name, phone, address_1, and country in the /load.php file.
Risk Assessment
An attacker can remotely exploit this vulnerability, potentially leading to user data theft or session hijacking.
Recommendation
It is recommended to update to the latest version of the software and implement input validation to prevent XSS attacks.
Original NVD description (English source)
A vulnerability was found in GZ Scripts Time Slot Booking Calendar PHP 1.8. It has been declared as problematic. This vulnerability affects unknown code of the file /load.php. The manipulation of the argument first_name/second_name/phone/address_1/country leads to cross site scripting. The attack can be initiated remotely. The identifier of this vulnerability is VDB-233296. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.