CVE-2016-20084

Name of the Vulnerable Software and Affected Versions appointment-booking-calendar version 1.1.24

Description Multiple privilege escalation issues allow unauthenticated attackers to modify calendar settings and inject persistent cross-site scripting (XSS) payloads. XSS is a technique where malicious scripts are injected into trusted websites. The attack is performed via GET requests to the 'admin.php' endpoint, targeting the ict and ics options or the name parameter. This allows the execution of arbitrary scripts when the calendar is accessed or displayed within the administration interface.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.