Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
20 results
Jul 31, 2026A Cross-Site Request Forgery (CSRF) vulnerability has been identified in multiple PHP Jabbers scripts.CVE-2025-67651 · Websites & servers · PHP Jabbers · reported by cvd@cert.plMedium 6.9
A Cross-Site Request Forgery (CSRF) vulnerability has been identified in multiple PHP Jabbers scripts. The lack of CSRF tokens or appropriate SameSite attributes allows an attacker to send unauthorized requests in the context of an authenticated user, leading to unauthorized administrative actions, such as creating new admin accounts. This issue was fixed in the versions specified in the affected products list.
- Product
- Appointment Scheduler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2026An authenticated SQL injection vulnerability has been identified in multiple PHP Jabbers scripts.CVE-2025-67650 · Websites & servers · PHP Jabbers · reported by cvd@cert.plHigh 8.6
An authenticated SQL injection vulnerability has been identified in multiple PHP Jabbers scripts. Improper neutralization of input provided by an authenticated user into parameters responsible for sorting functions allows an attacker to perform SQL Injection attacks. This issue was fixed in the versions specified in the affected products list.
- Product
- Appointment Scheduler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Easy!Appointments is a self hosted appointment scheduler.CVE-2026-55651 · Other software · alextselegidis · reported by GitHubHigh 7.1
Easy!Appointments is a self hosted appointment scheduler. In version 1.5.2, an Excessive Data Exposure vulnerability in the customers search endpoint allows an authenticated user to obtain appointment hashes belonging to other users. Using these hashes, an attacker can modify or delete appointments of other providers, resulting in an Appointments Takeover. Version 1.6.0 fixes the issue.
- Product
- easyappointments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Easy!Appointments is a self hosted appointment scheduler.CVE-2026-52841 · Other software · alextselegidis · reported by GitHubLow 3.1
Easy!Appointments is a self hosted appointment scheduler. In versions prior to 1.6.0, `Google::oauth` at `application/controllers/Google.php:278` stores its URL-supplied `provider_id` in the session, and `oauth_callback` saves the issued Google OAuth token against that row without checking the caller owns the provider. Any logged-in backend user (admin, provider, or secretary) rebinds a peer provider's Google sync to a Google account they control. The peer's appointments then sync into the attacker's calendar with each customer's name and email attached as attendee data. Version 1.6.0 patches the issue.
- Product
- easyappointments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Easy!Appointments is a self hosted appointment scheduler.CVE-2026-52840 · Other software · alextselegidis · reported by GitHubLow 2.7
Easy!Appointments is a self hosted appointment scheduler. In versions prior to 1.6.0, `Caldav::connect_to_server` at `application/controllers/Caldav.php:60` hands the request's `caldav_url` to a Guzzle `REPORT` call without scheme or host validation. A logged-in backend user (admin, provider, or secretary) reaches loopback, RFC1918, and link-local hosts on the deployment's network. The Guzzle exception path returns the upstream status code plus ~120 bytes of response body in the JSON `message` field (`Caldav.php:74-78`), so the SSRF is semi-blind. Version 1.6.0 contains a patch.
- Product
- easyappointments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Easy!Appointments is a self hosted appointment scheduler.CVE-2026-52839 · Other software · alextselegidis · reported by GitHubLow 3.3
Easy!Appointments is a self hosted appointment scheduler. Versions prior to 1.6.0 correctly filter provider-scoped appointments in the `appointments/search` response, proving that provider isolation is an intended security boundary. However, the direct mutation endpoints `appointments/store` and `appointments/update` only check generic appointment privileges and never verify that the submitted `id_users_provider` belongs to the current session. A normal authenticated provider can inject new appointments into another provider's schedule via `store`, or reassign existing appointments into a foreign provider's calendar via `update`. The `store` path contains an additional write-before-crash bug: the unauthorized row is committed to the database before the controller crashes on a type error, so the attacker receives an error response while the foreign appointment is already persisted. Version 1.6.0 patches the issue.
- Product
- easyappointments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Easy!Appointments is a self hosted appointment scheduler.CVE-2026-52838 · Other software · alextselegidis · reported by GitHubLow 2.6
Easy!Appointments is a self hosted appointment scheduler. Versions prior to 1.6.0 allow administrators to define a custom "booking disabled" message through the booking settings page. That value is stored in the `disable_booking_message` setting via a rich-text editor and later passed directly to the public `booking_message` view without escaping or sanitization. An authenticated administrator can store HTML or JavaScript in this field, enable disabled-booking mode, and trigger stored XSS in every unauthenticated visitor who opens the public booking page. Version 1.6.0 fixes the issue.
- Product
- easyappointments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Easy!Appointments is a self hosted appointment scheduler.CVE-2026-52837 · Other software · alextselegidis · reported by GitHubMedium 6.9
Easy!Appointments is a self hosted appointment scheduler. In versions up to and including 1.5.2, the booking reschedule view at `/index.php/booking/reschedule/{appointment_hash}` (handled by `Booking::index()`) embeds the entire customer record as inline JavaScript (`const vars = {... "customer_data": {...}, ...}`) without authentication and without field whitelisting. Anyone in possession of the 12-character `appointment_hash` — which appears in plain text in reschedule emails, confirmation page URLs, and operator-side calendar links — can read every column of that customer's row in the `ea_users` table. Version 1.6.0 contains a patch.
- Product
- easyappointments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2026Easy!Appointments is a self hosted appointment scheduler.CVE-2026-23622 · Other software · alextselegidis · reported by GitHubHigh 7.4
Easy!Appointments is a self hosted appointment scheduler. In 1.5.2 and earlier, application/core/EA_Security.php::csrf_verify() only enforces CSRF for POST requests and returns early for non-POST methods. Several application endpoints perform state-changing operations while accepting parameters from GET (or $_REQUEST), so an attacker can perform CSRF by forcing a victim's browser to issue a crafted GET request. Impact: creation of admin accounts, modification of admin email/password, and full admin account takeover.
- Product
- easyappointments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2025Appointy Appointment Scheduler: Cross-Site Request Forgery (CSRF)CVE-2025-31601 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in appointy Appointy Appointment Scheduler appointy-appointment-scheduler allows Cross Site Request Forgery.This issue affects Appointy Appointment Scheduler: from n/a through <= 4.2.1.
- Product
- Appointy Appointment Scheduler
- Affected
- up to 4.2.1
- What to do
- Affects up to 4.2.1. Update Appointy Appointment Scheduler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 31, 2025A Host Header Poisoning Open Redirect issue in slabiak Appointment Scheduler v.1.0.5 allows a remote attacker to redirect users to a malicious website, leading CVE-2024-42671 · Other software · reported by MITREMedium 6.1
A Host Header Poisoning Open Redirect issue in slabiak Appointment Scheduler v.1.0.5 allows a remote attacker to redirect users to a malicious website, leading to potential credential theft, malware distribution, or other malicious activities.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023Appointment Scheduler 3.0 is vulnerable to CSV Injection via a Language > Labels > Export action.CVE-2023-48841 · Websites & servers · Phpjabbers · reported by MITREHigh 8.8
Appointment Scheduler 3.0 is vulnerable to CSV Injection via a Language > Labels > Export action.
- Product
- Appointment Scheduler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comphpjabbers.com
Dec 7, 2023A lack of rate limiting in pjActionAjaxSend in Appointment Scheduler 3.0 allows attackers to cause resource exhaustion.CVE-2023-48840 · Websites & servers · Phpjabbers · reported by MITREHigh 7.5
A lack of rate limiting in pjActionAjaxSend in Appointment Scheduler 3.0 allows attackers to cause resource exhaustion.
- Product
- Appointment Scheduler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comphpjabbers.com
Dec 7, 2023Appointment Scheduler 3.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) issues via the name, plugin_sms_api_key, plugin_sms_country_code, calendarCVE-2023-48839 · Websites & servers · Phpjabbers · reported by MITREMedium 5.4
Appointment Scheduler 3.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) issues via the name, plugin_sms_api_key, plugin_sms_country_code, calendar_id, title, country name, or customer_name parameter.
- Product
- Appointment Scheduler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comphpjabbers.com
Dec 7, 2023Appointment Scheduler 3.0 is vulnerable to Multiple HTML Injection issues via the SMS API Key or Default Country Code.CVE-2023-48838 · Websites & servers · Phpjabbers · reported by MITREMedium 5.4
Appointment Scheduler 3.0 is vulnerable to Multiple HTML Injection issues via the SMS API Key or Default Country Code.
- Product
- Appointment Scheduler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comphpjabbers.com
Oct 10, 2023User enumeration is found in in PHPJabbers Appointment Scheduler 3.0.CVE-2023-36127 · Websites & servers · Phpjabbers · reported by MITREHigh 7.5
User enumeration is found in in PHPJabbers Appointment Scheduler 3.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
- Product
- Appointment Scheduler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2023There is a Cross Site Scripting (XSS) vulnerability in the "theme" parameter of preview.php in PHPJabbers Appointment Scheduler v3.0CVE-2023-36126 · Websites & servers · Phpjabbers · reported by MITREMedium 6.1
There is a Cross Site Scripting (XSS) vulnerability in the "theme" parameter of preview.php in PHPJabbers Appointment Scheduler v3.0
- Product
- Appointment Scheduler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2020Multiple cross-site scripting (XSS) vulnerabilities exist in PHPJabbers Appointment Scheduler 2.3, in the index.php admin login webpage (with different request CVE-2020-35416 · Other software · Onlineonly · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities exist in PHPJabbers Appointment Scheduler 2.3, in the index.php admin login webpage (with different request parameters), allows remote attackers to inject arbitrary web script or HTML.
- Product
- Phpjabbers Appointment Scheduler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Jan 13, 2015Directory traversal vulnerability in PHPJabbers Appointment Scheduler 2.0 allows remote attackers to read arbitrary files via a ..CVE-2014-10010 · Websites & servers · Phpjabbers · reported by MITREMedium 5
Directory traversal vulnerability in PHPJabbers Appointment Scheduler 2.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the id parameter in a pjActionDownload action to the pjBackup controller.
- Product
- Appointment Scheduler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Jan 13, 2015Multiple cross-site request forgery (CSRF) vulnerabilities in PHPJabbers Appointment Scheduler 2.0 allow remote attackers to hijack the authentication of adminiCVE-2014-10001 · Websites & servers · Phpjabbers · reported by MITREMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in PHPJabbers Appointment Scheduler 2.0 allow remote attackers to hijack the authentication of administrators for requests that (1) conduct cross-site scripting (XSS) attacks via the i18n[1][name] parameter in a pjActionCreate action to the pjAdminServices controller or (2) add an administrator via a pjActionCreate action to the pjAdminUsers controller.
- Product
- Appointment Scheduler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comsecunia.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.