PatchTheCVEappointment scheduler vulnerabilities and fixes
Recent CVEs affecting appointment scheduler, with upgrade or downgrade steps. 7 tracked.
Also searched as: appointmentscheduler.
appointment scheduler has 7 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 1. Most recent: 2023-12-07. Highest priority: CVE-2023-48841 (score 53/100).
- CVE-2023-48841 HIGH 8.8 DOWNGRADE Appointment Scheduler 3.0 is vulnerable to CSV Injection via a Language > Labels > Export action.
- CVE-2023-48840 HIGH 7.5 DOWNGRADE A lack of rate limiting in pjActionAjaxSend in Appointment Scheduler 3.0 allows attackers to cause resource ex
- CVE-2023-48839 MEDIUM 5.4 DOWNGRADE Appointment Scheduler 3.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) issues via the name, plu
- CVE-2023-48838 MEDIUM 5.4 DOWNGRADE Appointment Scheduler 3.0 is vulnerable to Multiple HTML Injection issues via the SMS API Key or Default Count
- CVE-2023-36127 HIGH 7.5 DOWNGRADE User enumeration is found in in PHPJabbers Appointment Scheduler 3.0
- CVE-2023-36126 MEDIUM 6.1 DOWNGRADE There is a Cross Site Scripting (XSS) vulnerability in the "theme" parameter of preview.php in PHPJabbers Appo
- CVE-2019-25094 LOW 3.5 UPGRADE A vulnerability, which was classified as problematic, was found in innologi appointments Extension up to 2.0.5
FAQ
How do I fix appointment scheduler vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is appointment scheduler being exploited right now?
None of the tracked appointment scheduler CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which appointment scheduler CVE should I patch first?
CVE-2023-48841 currently ranks highest (53/100): Appointment Scheduler 3.0 is vulnerable to CSV Injection via a Language > Labels > Export action..