169 matches found
Stored HTML Injection
alextselegidis/easyappointments is vulnerable to Stored HTML Injection. The vulnerability is due to improper sanitization in the compony name field, which allows an attacker to inject and execute malicious code into the system...
Session Fixation Vulnerability
Description It was noticed that the easyappointments application is vulnerable to Session Fixation vulnerability. The application does not generate a new easession cookie after the user authenticate successfully into the application. A malicious user is able to create a new session cookie value a...
GHSA-9QVW-FHJ2-XQMV Code Injection in alextselegidis/easyappointments
Code Injection in GitHub repository alextselegidis/easyappointments prior to 1.5.0 due to unescaped output...
Code Injection in alextselegidis/easyappointments
Code Injection in GitHub repository alextselegidis/easyappointments prior to 1.5.0 due to unescaped output...
CVE-2023-1367
Code Injection in GitHub repository alextselegidis/easyappointments prior to 1.5.0...
PT-2023-16934 · Unknown · Easyappointments
Name of the Vulnerable Software and Affected Versions: easyappointments versions prior to 1.5.0 Description: The issue is related to code injection in the GitHub repository alextselegidis/easyappointments due to unescaped output. This allows for potential code injection attacks. Recommendations:...
CVE-2023-1367 Code Injection in alextselegidis/easyappointments
Code Injection in GitHub repository alextselegidis/easyappointments prior to 1.5.0...
CVE-2023-1367 Code Injection in alextselegidis/easyappointments
Code Injection in GitHub repository alextselegidis/easyappointments prior to 1.5.0...
CVE-2023-1367
CVE-2023-1367 — Code Injection in easyappointments (GitHub: alextselegidis/easyappointments) Concrete details in connected documents confirm a vulnerability in Easy!Appointments versions prior to 1.5.0 caused by unescaped output, enabling code injection. Public sources note an HTML injection vect...
Stored HTML Injection via Company Name
Description easyappointments present an html injection vulnerability on the company name field on "/index.php/backend/settings" page. Steps: 1. login as admin 2. go to /index.php/backend/settings Page 3. insert the payload in Company Name field 4. go back to the home page and see the result. Proo...
CVE-2023-1269
Use of Hard-coded Credentials in GitHub repository alextselegidis/easyappointments prior to 1.5.0...
Hardcoded credentials
Use of Hard-coded Credentials in GitHub repository alextselegidis/easyappointments prior to 1.5.0...
PT-2023-16850 · Unknown · Easyappointments
Name of the Vulnerable Software and Affected Versions: easyappointments versions prior to 1.5.0 Description: The issue concerns the use of hard-coded credentials in the GitHub repository alextselegidis/easyappointments. Recommendations: For versions prior to 1.5.0, update to version 1.5.0 or late...
CVE-2023-1269 Use of Hard-coded Credentials in alextselegidis/easyappointments
Use of Hard-coded Credentials in GitHub repository alextselegidis/easyappointments prior to 1.5.0...
CVE-2023-1269 Use of Hard-coded Credentials in alextselegidis/easyappointments
Use of Hard-coded Credentials in GitHub repository alextselegidis/easyappointments prior to 1.5.0...
CVE-2023-1269 Use of Hard-coded Credentials in alextselegidis/easyappointments
Use of Hard-coded Credentials in GitHub repository alextselegidis/easyappointments prior to 1.5.0...
CVE-2023-1269
CVE-2023-1269 affects Easy!Appointments (GitHub repo alextselegidis/easyappointments) prior to version 1.5.0. The root cause is hard-coded credentials in the repository. Impact described in sources centers on credential exposure; exploitation details are not provided in the documents. A fix is av...
Use of Hard-coded Credentials
Use of Hard-coded Credentials in GitHub repository alextselegidis/easyappointments prior to 1.5.0...
Account Takeover
Description In this case i found that api endpoint Leaking password and username. Proof of Concept 1. An Admin add a new secretary with access to providers 2. Secretary send a post request to https://demo.easyappointments.org/index.php/backendapi/ajaxgetcalendarappointments endpoint 3. If selecte...