exploit-CVE-2022-0482

Divulgazione di PII in Easy!Appointments Easy!Appointments --debug exploit.rb -h | --help Options: Root URL base path including HTTP scheme, port and root folder All events since default: 2015-01-11 All events until default: today --debug Display arguments -h, --help Show this screen Examples:...

CVE-2026-61946-Easy-Appointments-IDOR

CVE-2026-61946: Da un ID Appuntamento alla Prenotazione di Qualcun Altro Ho trovato un riferimento diretto a oggetti insicuro IDOR, sfruttabile senza autenticazione, nel plugin WordPress Easy Appointments. L'endpoint pubblico di prenotazione accettava un id dalla query string e passava i dati...

CVE-2026-16540-SimplyScheduleAppointments

CVE-2026-16540 — Simply Schedule Appointments 1.6.12.6 Unauthentifizierte Offenlegung von Termindaten und Massenlöschung über den purge-Endpunkt...

Easy Appointments <= 3.12.21 - Information Disclosure

Easy Appointments WordPress plugin = 3.12.21 contains a sensitive information exposure caused by an unauthenticated REST API endpoint /wp-json/wp/v2/eablocks/eaappointments/ registered with permissioncallback allowing unrestricted access, letting unauthenticated attackers extract sensitive custom...

WordPress Simply Schedule Appointments <1.5.7.7 - Information Disclosure

WordPress Simply Schedule Appointments plugin before 1.5.7.7 is susceptible to information disclosure. The plugin is missing authorization in a REST endpoint, which can allow an attacker to retrieve user details such as name and email address. id: CVE-2022-2373 info: name: WordPress Simply Schedu...

CVE-2025-50383

CVE-2025-50383 Descrizione Un utente autenticato con privilegi ridotti può sfruttare questa vulnerabilità inviando una richiesta HTTP POST appositamente modificata con un parametro orderby malevolo ad esempio, orderby=IF1=1,SLEEP5,1. Ciò può innescare un attacco SQL injection cieco basato sul...

CVE-2026-14216

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.7 does not require authentication before processing its pending notification queue, allowing an unauthenticated user to force the dispatch of queued notifications and integration callbacks...

CVE-2026-14212

The Booking for Appointments and Events Calendar WordPress plugin before 9.8 does not verify that an authenticated employee provider owns the provider account being updated, allowing any employee with an Employee Panel login to overwrite another employee's cabinet password and take over their...

EUVD-2026-66268

The Booking for Appointments and Events Calendar WordPress plugin before 9.8 does not verify that an authenticated employee provider owns the provider account being updated, allowing any employee with an Employee Panel login to overwrite another employee's cabinet password and take over their...

EUVD-2026-66269

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.7 does not require authentication before processing its pending notification queue, allowing an unauthenticated user to force the dispatch of queued notifications and integration callbacks...

PT-2026-81945

The Booking for Appointments and Events Calendar WordPress plugin before 9.8 does not verify that an authenticated employee provider owns the provider account being updated, allowing any employee with an Employee Panel login to overwrite another employee's cabinet password and take over their...

CVE-2022-0482_exploit

Ausnutzung der Schwachstelle CVE-2022-0482 Einleitung Dieses Dokument beschreibt die detaillierte Analyse von CVE-2022-0482, einer kritischen Sicherheitsschwachstelle in der Terminplanungssoftware Easy!Appointments. Dieser Fehler, der unter CWE-863 als fehlerhafte Autorisierung eingestuft wird,...

CVE-2025-29448

CVE-2025-29448 Descrição falha na lógica de agendamento no Easy!Appointments v1.5.1 permite que atacantes não autenticados criem compromissos com durações excessivamente longas, causando uma negação de serviço ao bloquear toda a disponibilidade futura de agendamentos. Passos para Reproduzir 1...

CVE-2026-19406

The Easy Appointments WordPress plugin before 4.0.1 does not restrict one of its appointment-listing REST endpoints to the records belonging to the requesting user, allowing users with contributor-level access to read all bookings on the site, including customer names, schedules, and statuses...

EUVD-2026-62288

The Easy Appointments WordPress plugin before 4.0.1 does not restrict one of its appointment-listing REST endpoints to the records belonging to the requesting user, allowing users with contributor-level access to read all bookings on the site, including customer names, schedules, and statuses...

CVE-2026-19406

The Easy Appointments WordPress plugin before 4.0.1 exposes an appointment-listing REST endpoint without per-user scoping, letting contributor-level accounts read all site bookings including customer names, schedules, and statuses. Fix is to upgrade to version 4.0.1 or later. No in-the-wild explo...

CVE-2026-19406 Easy Appointments < 4.0.1 - Contributor+ Sensitive Information Disclosure via REST Appointments Listing

The Easy Appointments WordPress plugin before 4.0.1 does not restrict one of its appointment-listing REST endpoints to the records belonging to the requesting user, allowing users with contributor-level access to read all bookings on the site, including customer names, schedules, and statuses...

EUVD-2026-60357

The CRM+ application before and including version 2025.6 from Brainformatik is vulnerable to SQL Injection time-based vulnerability. The check conflict endpoint index.php?module=Appointments&action=CheckConflictOfDates&ajaxSkipHeader=true which is used to check any conflicts for user calendar is...

CVE-2026-13358

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.12.10 via the ssapastappointments due to missing validation on a user controlled key. This makes it...

CVE-2026-13358 Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.12.10 - Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.12.10 via the ssapastappointments due to missing validation on a user controlled key. This makes it...