Search for packages
| purl | pkg:composer/alextselegidis/easyappointments@1.3.0-alpha.1 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score | 10.0 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-3wf7-83q3-948c
Aliases: CVE-2024-57601 |
Remote code execution in alextselegidis/easyappointments Cross Site Scripting vulnerability in Alex Tselegidis EasyAppointments v.1.5.0 allows a remote attacker to execute … | There are no reported fixed by versions. |
|
GHSA-8fc2-fhh6-f6m5
Aliases: CVE-2024-57602 |
Easy!Appointments Improper Restriction of Excessive Authentication Attempts An issue in Alex Tselegidis EasyAppointments v.1.5.0 allows a remote attacker to escalate … | There are no reported fixed by versions. |
|
GHSA-hcjv-982c-5f29
Aliases: CVE-2025-29448 |
Easy!Appointments Denial of Service (DoS) Booking logic flaw in Easy!Appointments v1.5.1 allows unauthenticated attackers to create appointments with excessively long … | There are no reported fixed by versions. |
|
GHSA-2f28-69j7-85hf
Aliases: CVE-2025-50383 |
Easy!Appointments SQL injection vulnerability alextselegidis Easy!Appointments v1.5.1 was discovered to contain a SQL injection vulnerability via the order_by parameter. | There are no reported fixed by versions. |
|
GHSA-7f62-4887-cfv5
Aliases: CVE-2022-1397 |
Privilege escalation in easyappointments The Easy!Appointments API authorization is checked against the user's existence, without validating the permissions. As a … | There are no reported fixed by versions. |
|
GHSA-r6cm-wg48-rh2r
Aliases: CVE-2022-0482 |
Exposure of Private Personal Information to an Unauthorized Actor in alextselegidis/easyappointments The software is a booking management system that has … |
Vulnerable |
|
GHSA-7m8r-gmc3-3p4v
Aliases: CVE-2023-2103 |
alextselegidis/easyappointments vulnerable to Stored Cross-site Scripting alextselegidis/easyappointments is vulnerable to stored cross-site scripting in versions 1.4.3 and prior. A patch … | There are no reported fixed by versions. |
|
GHSA-347f-rxg8-qgrv
Aliases: CVE-2023-1269 |
Easy!Appointments uses hard-coded credentials Use of Hard-coded Credentials in GitHub repository alextselegidis/easyappointments 1.4.3 and prior. A patch is available and … | There are no reported fixed by versions. |
|
GHSA-9qvw-fhj2-xqmv
Aliases: CVE-2023-1367 |
Code Injection in alextselegidis/easyappointments Code Injection in GitHub repository alextselegidis/easyappointments prior to 1.5.0 due to unescaped output. | There are no reported fixed by versions. |
|
GHSA-54v4-4685-vwrj
Aliases: CVE-2026-23622 |
alextselegidis/easyappointments is Vulnerable to CSRF Protection Bypass ### Summary `application/core/EA_Security.php::csrf_verify()` only enforces CSRF for POST requests and returns early for … | There are no reported fixed by versions. |
|
GHSA-4qmm-cv4r-qfr4
Aliases: CVE-2023-2105 |
alextselegidis/easyappointments Session Fixation vulnerability alextselegidis/easyappointments is vulnerable to session fixation. The application does not generate a new `ea_session` cookie after … | There are no reported fixed by versions. |
|
GHSA-j6qq-9939-9jv8
Aliases: CVE-2023-2102 |
alextselegidis/easyappointments vulnerable to Stored Cross-site Scripting alextselegidis/easyappointments is vulnerable to stored cross-site scripting in versions 1.4.3 and prior. A patch … | There are no reported fixed by versions. |
|
GHSA-fc4g-f42p-7rhp
Aliases: CVE-2023-2104 |
alextselegidis/easyappointments Improper Access Control vulnerability alextselegidis/easyappointments 1.4.3 and prior allows one provider to view and edit others providers' appointment details. … | There are no reported fixed by versions. |
|
GHSA-8c6q-26w6-qwhg
Aliases: CVE-2023-3700 |
Easy!Appointments Improper Access Control vulnerability Easy!Appointments 1.4.3 and prior has an Improper Access Control vulnerability. This issue is patched at … | There are no reported fixed by versions. |
|
GHSA-996f-334j-67g7
Aliases: CVE-2026-52838 |
Easy!Appointments disable_booking_message rendered as raw HTML on public booking page — Stored XSS ## Summary Easy!Appointments allows administrators to define … | There are no reported fixed by versions. |
|
GHSA-8hm4-r66f-29wr
Aliases: CVE-2026-52841 |
Easy!Appointments: Authorization bypass in Google OAuth provider binding lets any backend user rebind a peer provider's Google sync ### Summary … | There are no reported fixed by versions. |
|
GHSA-w8xc-8g92-v77h
Aliases: CVE-2026-52839 |
Easy!Appointments appointments/store and appointments/update allow cross-provider appointment injection — Authorization Bypass ## Summary Easy!Appointments correctly filters provider-scoped appointments in the … | There are no reported fixed by versions. |
|
GHSA-xgr6-pqjv-3pf8
Aliases: CVE-2026-52837 |
Easy!Appointments has unauthenticated customer PII disclosure on booking reschedule page ## Summary The booking reschedule view at `/index.php/booking/reschedule/{appointment_hash}` (handled by … | There are no reported fixed by versions. |
|
GHSA-pm5p-7w5h-jm5q
Aliases: CVE-2026-52840 |
Easy!Appointments has server-side request forgery in CalDAV connection test that exposes the deployment's internal network ### Summary `Caldav::connect_to_server` at `application/controllers/Caldav.php:60` … | There are no reported fixed by versions. |