CVE-2023-3559 LOW

CVE-2023-3559: GZ Scripts PHP GZ Appointment Scheduling Script load.php cross site scripting

Vendor Gz Scripts
Product PHP GZ Appointment Scheduling Script
Weakness CWE-79 · XSS
Published July 8, 2023
Last update October 23, 2024
View on NVD All CVEs

CVSS base score

3.5/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction Required
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

A vulnerability classified as problematic was found in GZ Scripts PHP GZ Appointment Scheduling Script 1.8. Affected by this vulnerability is an unknown functionality of the file /load.php. The manipulation of the argument first_name/second_name/phone/address_1/country leads to cross site scripting. The attack can be launched remotely. The identifier VDB-233353 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Key dates

02Disclosure timeline

July 8, 2023 CVE published
October 23, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-64851 Grav Shortcode Core Plugin: Stored XSS in shortcode-core attribute handlers CVE-2026-18323 Forminator Forms <= 1.57.0.2 - Unauthenticated Stored Cross-Site Scripting via Radio Field (Save and Continue Draft) CVE-2026-3129 LiteSpeed Cache <= 7.7 - Authenticated (Author+) Stored Cross-Site Scripting via img Tag Attributes CVE-2026-66917 Joomla Extension - joomgalleryfriends.net - Stored XSS in JoomGallery < 4.4.0 CVE-2026-78073 Joomla Extension - j2commerce.com - Reflected XSS attribute in All Video Share 1.0.0-4.5.0