PatchTheCVECVE-2019-25094: A vulnerability, which was classified as problematic, was found in innologi appointments Extension up to 2.0.5
CVE-2019-25094 is a low-severity flaw (CVSS 3.5) affecting appointment scheduler. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
A vulnerability, which was classified as problematic, was found in innologi appointments Extension up to 2.0.5 on TYPO3. This affects an unknown part of the component Appointment Handler. The manipulation of the argument formfield leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 2.0.6 is able to address this issue. The identifier of the patch is 986d3cb34e5e086c6f04e061f600ffc5837abe7f. It is rec
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 3.5 (Low) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | Required |
| EPSS exploit chance | 0.6% (top 53%) |
| CISA exploited list | No |
| Weakness | CWE-79 |
| Published | 2023-01-04 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2019-25094?
appointment scheduler: upgrade to 2.0.6. Exact commands for each OS are on this page.
Is CVE-2019-25094 being exploited?
CVE-2019-25094 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2019-25094 affect?
CVE-2019-25094 affects appointment scheduler. Severity is low (CVSS 3.5). A vulnerability, which was classified as problematic, was found in innologi appointments Extension up to 2.0.5 on TYPO3. This affects an unknown part of the component Appointment Handler. The manipulation of the argument formfield leads to
How urgent is CVE-2019-25094?
Priority 24/100. No elevated risk signals yet.
Software pages
Related CVEs
- CVE-2023-48841 HIGH 8.8 DOWNGRADE Appointment Scheduler 3.0 is vulnerable to CSV Injection via a Language > Labels > Export action.
- CVE-2023-48840 HIGH 7.5 DOWNGRADE A lack of rate limiting in pjActionAjaxSend in Appointment Scheduler 3.0 allows attackers to cause resource ex
- CVE-2023-48839 MEDIUM 5.4 DOWNGRADE Appointment Scheduler 3.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) issues via the name, plu
- CVE-2023-48838 MEDIUM 5.4 DOWNGRADE Appointment Scheduler 3.0 is vulnerable to Multiple HTML Injection issues via the SMS API Key or Default Count
- CVE-2023-36127 HIGH 7.5 DOWNGRADE User enumeration is found in in PHPJabbers Appointment Scheduler 3.0