CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 14/07/2026 |
| CVE-2026-52839 | 낮음3.3 | Easy!Appointments is a self hosted appointment scheduler. Versions prior to 1.6.0 correctly filter provider-scoped appointments in the `appointments/search` response, proving that provider isolation is an intended security boundary. However, the direct mutation endpoints `appointments/store` and `appointments/update` o | 14/07/2026 |
| CVE-2026-52838 | 낮음2.6 | Easy!Appointments is a self hosted appointment scheduler. Versions prior to 1.6.0 allow administrators to define a custom "booking disabled" message through the booking settings page. That value is stored in the `disable_booking_message` setting via a rich-text editor and later passed directly to the public `booking_me | 14/07/2026 |
| CVE-2026-52837 | 보통6.9 | Easy!Appointments is a self hosted appointment scheduler. In versions up to and including 1.5.2, the booking reschedule view at `/index.php/booking/reschedule/{appointment_hash}` (handled by `Booking::index()`) embeds the entire customer record as inline JavaScript (`const vars = {... "customer_data": {...}, ...}`) wit | 14/07/2026 |
| CVE-2026-23622 | 높음8.8 | Easy!Appointments is a self hosted appointment scheduler. In 1.5.2 and earlier, application/core/EA_Security.php::csrf_verify() only enforces CSRF for POST requests and returns early for non-POST methods. Several application endpoints perform state-changing operations while accepting parameters from GET (or $_REQUEST), | 15/01/2026 |
| CVE-2025-50383 | 높음8.1 | alextselegidis Easy!Appointments v1.5.1 was discovered to contain a SQL injection vulnerability via the order_by parameter. | 25/08/2025 |
| CVE-2025-29448 | 높음7.5 | Booking logic flaw in Easy!Appointments v1.5.1 allows unauthenticated attackers to create appointments with excessively long durations, causing a denial of service by blocking all future booking availability. | 07/05/2025 |
| CVE-2024-57602 | 심각9.8 | An issue in Alex Tselegidis EasyAppointments v.1.5.0 allows a remote attacker to escalate privileges via the index.php file. | 12/02/2025 |
| CVE-2024-57601 | 보통6.1 | Cross Site Scripting vulnerability in Alex Tselegidis EasyAppointments v.1.5.0 allows a remote attacker to execute arbitrary code via the legal_settings parameter. | 12/02/2025 |
| CVE-2023-3700 | 보통4.3 | Authorization Bypass Through User-Controlled Key in GitHub repository alextselegidis/easyappointments prior to 1.5.0.
| 17/07/2023 |
| CVE-2023-2105 | 높음8.8 | Session Fixation in GitHub repository alextselegidis/easyappointments prior to 1.5.0. | 15/04/2023 |
| CVE-2023-2104 | 보통5.4 | Improper Access Control in GitHub repository alextselegidis/easyappointments prior to 1.5.0. | 15/04/2023 |
| CVE-2023-2103 | 보통5.4 | Cross-site Scripting (XSS) - Stored in GitHub repository alextselegidis/easyappointments prior to 1.5.0. | 15/04/2023 |
| CVE-2023-2102 | 보통4.8 | Cross-site Scripting (XSS) - Stored in GitHub repository alextselegidis/easyappointments prior to 1.5.0. | 15/04/2023 |
| CVE-2023-1367 | 낮음3.8 | Code Injection in GitHub repository alextselegidis/easyappointments prior to 1.5.0. | 13/03/2023 |
| CVE-2023-1269 | 심각9.8 | Use of Hard-coded Credentials in GitHub repository alextselegidis/easyappointments prior to 1.5.0. | 08/03/2023 |
| CVE-2022-1397 | 높음8.8 | API Privilege Escalation in GitHub repository alextselegidis/easyappointments prior to 1.5.0. Full system takeover. | 10/05/2022 |
| CVE-2022-0482 | 심각9.1 | Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository alextselegidis/easyappointments prior to 1.4.3. | 09/03/2022 |