167 matches found
Easy!Appointments <1.4.3 - Broken Access Control
Easy!Appointments prior to 1.4.3 allows exposure of Private Personal Information to an unauthorized actor via the GitHub repository alextselegidis/easyappointments. id: CVE-2022-0482 info: name: Easy!Appointments 1.4.3 - Broken Access Control author: francescocarlucci,opencirt severity: critical...
alextselegidis/easyappointments is Vulnerable to CSRF Protection Bypass
Summary application/core/EASecurity.php::csrfverify only enforces CSRF for POST requests and returns early for non-POST methods. Several application endpoints perform state-changing operations while accepting parameters from GET or $REQUEST, so an attacker can perform CSRF by forcing a victim's...
CVE-2026-23622 CSRF Protection Bypass: Sensitive endpoints accept GET requests, enabling admin account takeover
Easy!Appointments is a self hosted appointment scheduler. In 1.5.2 and earlier, application/core/EASecurity.php::csrfverify only enforces CSRF for POST requests and returns early for non-POST methods. Several application endpoints perform state-changing operations while accepting parameters from...
PT-2026-3099
Name of the Vulnerable Software and Affected Versions Easy!Appointments versions 1.5.2 and earlier Description The application's CSRF protection in application/core/EA Security.php::csrf verify only applies to POST requests, bypassing validation for other request methods like GET. Several...
Privilege Escalation
alextselegidis/easyappointments is vulnerable to Privilege Escalation. The vulnerability is due to improper access control in the index.php file, which allows a remote attacker to escalate privileges by exploiting insufficient authorization checks...
EUVD-2023-0842
Malicious code in bioql PyPI...
EUVD-2023-44219
Malicious code in bioql PyPI...
EUVD-2023-1287
Malicious code in bioql PyPI...
EUVD-2023-1331
Malicious code in bioql PyPI...
EUVD-2023-1193
Malicious code in bioql PyPI...
EUVD-2023-1230
Malicious code in bioql PyPI...
EUVD-2024-53639
Malicious code in bioql PyPI...
EUVD-2023-0971
Malicious code in bioql PyPI...
EUVD-2024-53638
Malicious code in bioql PyPI...
EUVD-2023-2002
Malicious code in bioql PyPI...
EUVD-2022-2979
Malicious code in bioql PyPI...
SQL Injection
Overview alextselegidis/easyappointments is a powerful Open Source Appointment Scheduler that can be installed on your server. Affected versions of this package are vulnerable to SQL Injection via the orderby parameter. An attacker can execute arbitrary SQL commands by supplying crafted input...
CVE-2023-2103
Cross-site Scripting XSS - Stored in GitHub repository alextselegidis/easyappointments prior to 1.5.0...
CVE-2023-2105
Session Fixation in GitHub repository alextselegidis/easyappointments prior to 1.5.0...
CVE-2023-1367
Code Injection in GitHub repository alextselegidis/easyappointments prior to 1.5.0...