CVE-2023-2103

Cross-site Scripting (XSS) - Stored in alextselegidis/easyappointments

4.3MediumCVSS base score
0.47%Exploitation in 30 daysEPSS · top 59% of all CVEs
NoKnown exploitednot in CISA's KEV catalog
YesPublic exploitsa reference or SSVC says so

Description

Cross-site Scripting (XSS) - Stored in GitHub repository alextselegidis/easyappointments prior to 1.5.0.

Public exploit

An exploit or proof of concept is public: anyone can try it against an unpatched system. CISA's SSVC rates its exploitation: a proof of concept is public.

Timeline

2023
15 Apr 2023
15 Apr 2023
Published
2025
6 Feb 202522 months later
6 Feb 2025· 22 months later
Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2023-2103, by who scored it
Scored by	CVSS	Score	Vector
@huntrdevCNA (assigner)	3.0	Medium4.3	CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
CISA-ADPADP (enrichment)	3.1	Medium5.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
NVDNVD · Modified	3.1	Medium5.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS (exploitation in 30 days): 0.47% · top 59% of all CVEs (11 Nov 2026)
CISA SSVC: Exploitation: poc · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.3.

Affected products

alextselegidis · alextselegidis/easyappointments
- affected unspecified – < 1.5.0

Affected packages

From reviewed advisories of the GitHub Advisory Database.

Packagistalextselegidis/easyappointmentsGHSA-7m8r-gmc3-3p4v (opens in a new tab)

References2

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2023-2103](https://cveledger.app/badge/CVE-2023-2103.svg)](https://cveledger.app/cve/CVE-2023-2103)

Record last updated 6 Feb 2025, 15:42 UTC.