CVE-2014-10001: Phpjabbers Appointment Scheduler

Medium severity, CVSS 6.8. EPSS: 2.3% chance of exploitation in the next 30 days.

Multiple cross-site request forgery (CSRF) vulnerabilities in PHPJabbers Appointment Scheduler 2.0 allow remote attackers to hijack the authentication of administrators for requests that (1) conduct cross-site scripting (XSS) attacks via the i18n[1][name] parameter in a pjActionCreate action to the pjAdminServices controller or (2) add an administrator via a pjActionCreate action to the pjAdminUsers controller.

Affected products

• Phpjabbers Appointment Scheduler: version 2.0 only

Published 2015-01-13. Last modified 2026-06-17.