CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SwiftCloud Swift Calendar Online Appointment Scheduling online-appointment-scheduling-software allows Reflected XSS.This issue affects Swift Calendar Online Appointment Scheduling: from n/a through <= 1.3.3.
Explanation of Vulnerability in Simple Terms
Swift Calendar Online Appointment Scheduling versions 1.3.3 and earlier contain a cross-site scripting (XSS) vulnerability. An attacker can inject malicious scripts that execute in users' browsers when they visit affected pages. The vulnerability requires user interaction and can affect other users or the site itself depending on where the injection occurs.
What an attacker can do
Inject malicious scripts that run in users' browsers and steal session data, redirect users, or deface the calendar interface.
Potential impact on your site
Users visiting the calendar may have their sessions compromised or be redirected to malicious sites. Site reputation and user trust are at risk.
Conditions required to exploit
No authentication required. Victim must visit a page containing the attacker's malicious input (e.g., click a crafted link).
Key dates
External resources
Related vulnerabilities
