CyberRota Analysis
AI-GeneratedEasy!Appointments versions prior to 1.6.0 are vulnerable to stored cross-site scripting (XSS) due to improper handling of a custom "booking disabled" message set by administrators. This flaw allows authenticated administrators to inject malicious HTML or JavaScript, which can then be executed in the browsers of unauthenticated users visiting the public booking page. Organizations using affected versions should prioritize upgrading to version 1.6.0 to mitigate the risk of XSS attacks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Easy!Appointments is a self hosted appointment scheduler. Versions prior to 1.6.0 allow administrators to define a custom "booking disabled" message through the booking settings page. That value is stored in the `disable_booking_message` setting via a rich-text editor and later passed directly to the public `booking_message` view without escaping or sanitization. An authenticated administrator can store HTML or JavaScript in this field, enable disabled-booking mode, and trigger stored XSS in every unauthenticated visitor who opens the public booking page. Version 1.6.0 fixes the issue.