956 matches found
CVE-2026-61946-Easy-Appointments-IDOR
CVE-2026-61946: 1つの予約IDで他人の予約を上書き 私は、WordPressプラグインEasy Appointmentsに、認証なしの安全でないダイレクトオブジェクト参照（IDOR）を発見しました。公開予約エンドポイントはクエリ文字列からidを受け入れ、その結果のデータをプラグインのデータベースreplaceパスに渡していました。...
Easy Appointments <= 3.12.21 - Information Disclosure
Easy Appointments WordPress plugin = 3.12.21 contains a sensitive information exposure caused by an unauthenticated REST API endpoint /wp-json/wp/v2/eablocks/eaappointments/ registered with permissioncallback allowing unrestricted access, letting unauthenticated attackers extract sensitive custom...
WordPress Simply Schedule Appointments <1.5.7.7 - Information Disclosure
WordPress Simply Schedule Appointments plugin before 1.5.7.7 is susceptible to information disclosure. The plugin is missing authorization in a REST endpoint, which can allow an attacker to retrieve user details such as name and email address. id: CVE-2022-2373 info: name: WordPress Simply Schedu...
CVE-2025-29448
CVE-2025-29448 説明 Easy!Appointments v1.5.1 の予約ロジックの欠陥により、認証されていない攻撃者が過度に長い期間の予約を作成し、将来のすべての予約可能枠をブロックしてサービス拒否を引き起こすことが可能です。 再現手順 1. 予約リクエストを傍受する。 2. リクエストボディ内の postdataappointmentenddatetime パラメータを見つける。 3. パラメータ値を将来の遠い日付に変更し、リクエストを送信する。 4. アプリケーションは長時間の予約を受け入れ、将来のすべての利用可能枠をブロックしてサービス拒否を引き起こす。...
exploit-CVE-2022-0482
Easy!Appointments PII 情報漏洩 Easy!Appointments --debug exploit.rb -h | --help Options: Root URL base path including HTTP scheme, port and root folder All events since default: 2015-01-11 All events until default: today --debug Display arguments -h, --help Show this screen Examples: exploit.rb...
CVE-2026-16540-SimplyScheduleAppointments
CVE-2026-16540 — Simply Schedule Appointments WPRESTServer::READABLE, 'callback' = array $this, 'purgeappointments' , 'permissioncallback' = array $this, 'getitemspermissionscheck' , , ; 权限检查 — 通过 idtoken 验证对一个 预约的所有权： public function getitemspermissionscheck $request...
WordPress Simply Schedule Appointments plugin <= 1.6.12.31 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure vulnerability
Insecure Direct Object Reference to Authenticated Subscriber+ Sensitive Information Disclosure vulnerability discovered by jtb75 in WordPress Plugin Simply Schedule Appointments versions = 1.6.12.31...
WordPress Simply Schedule Appointments plugin <= 1.6.12.32 - Missing Authorization to Unauthenticated Sensitive Information Exposure and Arbitrary Appointment Deletion vulnerability
Missing Authorization to Unauthenticated Sensitive Information Exposure and Arbitrary Appointment Deletion vulnerability discovered by Md. Moniruzzaman Prodhan NomanProdhan in WordPress Plugin Simply Schedule Appointments versions = 1.6.12.32...
CVE-2026-91109
The Simply Schedule Appointments plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.12.31 via the 'completegroup' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...
CVE-2026-92245
The Simply Schedule Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.12.32 via the 'recursive' parameter. This makes it possible for unauthenticated attackers to extract customer PII — including names, email addresses, pho...
CVE-2026-91109
The Simply Schedule Appointments plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) in versions up to and including 1.6.12.31 . The root cause is a lack of validation on a user-controlled key within the 'complete_group' parameter. Authenticated attackers with subscri...
EUVD-2026-90466
The Simply Schedule Appointments plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.12.31 via the 'completegroup' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...
CVE-2026-91109 Simply Schedule Appointments <= 1.6.12.31 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'complete_group' Parameter
The Simply Schedule Appointments plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.12.31 via the 'completegroup' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...
EUVD-2026-90464
The Simply Schedule Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.12.32 via the 'recursive' parameter. This makes it possible for unauthenticated attackers to extract customer PII — including names, email addresses, pho...
CVE-2026-92245
The Simply Schedule Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure and Arbitrary Appointment Deletion in versions up to and including 1.6.12.32 . The root cause is a missing authorization flaw involving the recursive parameter on the appointment_types REST endpo...
CVE-2026-92245 Simply Schedule Appointments <= 1.6.12.32 - Missing Authorization to Unauthenticated Sensitive Information Exposure and Arbitrary Appointment Deletion via 'recursive' Parameter on the appointment_types REST Endpoint via Public Nonce
The Simply Schedule Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.12.32 via the 'recursive' parameter. This makes it possible for unauthenticated attackers to extract customer PII — including names, email addresses, pho...
CVE-2026-94673
Unauthenticated Insecure Direct Object References IDOR in Simply Schedule Appointments = 1.6.12.31 versions...
CVE-2026-94074
Unauthenticated Broken Access Control in Simply Schedule Appointments = 1.6.12.29 versions...