Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
40 results
Oct 11, 2026Easy!Appointments through 1.6.0 contains an authorization bypass vulnerability in Booking::register() that allows unauthenticated attackers to modify any appoinCVE-2026-108758 · Other software · alextselegidis · reported by VulnCheckHigh 8.8
Easy!Appointments through 1.6.0 contains an authorization bypass vulnerability in Booking::register() that allows unauthenticated attackers to modify any appointment by supplying an appointment id without its hash. Attackers can enumerate sequential appointment ids with a self-asserted manage_mode flag to rewrite appointment details, rebind them to attacker-controlled customers, and obtain management hashes for rescheduling or cancellation.
- Product
- easyappointments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 27, 2026SQL injection vulnerability exists in the order_by parameter of the /customers/search endpoint in Alex Tselegidis EasyAppointments <= 1.5.1.CVE-2025-50455 · Other software · reported by MITRECritical 9.1
SQL injection vulnerability exists in the order_by parameter of the /customers/search endpoint in Alex Tselegidis EasyAppointments <= 1.5.1. The vulnerability arises from unsanitized user input passed to the order_by method of the CodeIgniter Query Builder, enabling attackers to perform time-based queries and schema enumeration. Under certain MySQL configurations, the flaw may lead to remote code execution by writing a PHP shell using INTO OUTFILE.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Easy!Appointments is a self hosted appointment scheduler.CVE-2026-55651 · Other software · alextselegidis · reported by GitHubHigh 7.1
Easy!Appointments is a self hosted appointment scheduler. In version 1.5.2, an Excessive Data Exposure vulnerability in the customers search endpoint allows an authenticated user to obtain appointment hashes belonging to other users. Using these hashes, an attacker can modify or delete appointments of other providers, resulting in an Appointments Takeover. Version 1.6.0 fixes the issue.
- Product
- easyappointments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Easy!Appointments is a self hosted appointment scheduler.CVE-2026-52841 · Other software · alextselegidis · reported by GitHubLow 3.1
Easy!Appointments is a self hosted appointment scheduler. In versions prior to 1.6.0, `Google::oauth` at `application/controllers/Google.php:278` stores its URL-supplied `provider_id` in the session, and `oauth_callback` saves the issued Google OAuth token against that row without checking the caller owns the provider. Any logged-in backend user (admin, provider, or secretary) rebinds a peer provider's Google sync to a Google account they control. The peer's appointments then sync into the attacker's calendar with each customer's name and email attached as attendee data. Version 1.6.0 patches the issue.
- Product
- easyappointments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Easy!Appointments is a self hosted appointment scheduler.CVE-2026-52840 · Other software · alextselegidis · reported by GitHubLow 2.7
Easy!Appointments is a self hosted appointment scheduler. In versions prior to 1.6.0, `Caldav::connect_to_server` at `application/controllers/Caldav.php:60` hands the request's `caldav_url` to a Guzzle `REPORT` call without scheme or host validation. A logged-in backend user (admin, provider, or secretary) reaches loopback, RFC1918, and link-local hosts on the deployment's network. The Guzzle exception path returns the upstream status code plus ~120 bytes of response body in the JSON `message` field (`Caldav.php:74-78`), so the SSRF is semi-blind. Version 1.6.0 contains a patch.
- Product
- easyappointments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Easy!Appointments is a self hosted appointment scheduler.CVE-2026-52839 · Other software · alextselegidis · reported by GitHubLow 3.3
Easy!Appointments is a self hosted appointment scheduler. Versions prior to 1.6.0 correctly filter provider-scoped appointments in the `appointments/search` response, proving that provider isolation is an intended security boundary. However, the direct mutation endpoints `appointments/store` and `appointments/update` only check generic appointment privileges and never verify that the submitted `id_users_provider` belongs to the current session. A normal authenticated provider can inject new appointments into another provider's schedule via `store`, or reassign existing appointments into a foreign provider's calendar via `update`. The `store` path contains an additional write-before-crash bug: the unauthorized row is committed to the database before the controller crashes on a type error, so the attacker receives an error response while the foreign appointment is already persisted. Version 1.6.0 patches the issue.
- Product
- easyappointments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Easy!Appointments is a self hosted appointment scheduler.CVE-2026-52838 · Other software · alextselegidis · reported by GitHubLow 2.6
Easy!Appointments is a self hosted appointment scheduler. Versions prior to 1.6.0 allow administrators to define a custom "booking disabled" message through the booking settings page. That value is stored in the `disable_booking_message` setting via a rich-text editor and later passed directly to the public `booking_message` view without escaping or sanitization. An authenticated administrator can store HTML or JavaScript in this field, enable disabled-booking mode, and trigger stored XSS in every unauthenticated visitor who opens the public booking page. Version 1.6.0 fixes the issue.
- Product
- easyappointments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Easy!Appointments is a self hosted appointment scheduler.CVE-2026-52837 · Other software · alextselegidis · reported by GitHubMedium 6.9
Easy!Appointments is a self hosted appointment scheduler. In versions up to and including 1.5.2, the booking reschedule view at `/index.php/booking/reschedule/{appointment_hash}` (handled by `Booking::index()`) embeds the entire customer record as inline JavaScript (`const vars = {... "customer_data": {...}, ...}`) without authentication and without field whitelisting. Anyone in possession of the 12-character `appointment_hash` — which appears in plain text in reschedule emails, confirmation page URLs, and operator-side calendar links — can read every column of that customer's row in the `ea_users` table. Version 1.6.0 contains a patch.
- Product
- easyappointments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2026Easy!Appointments is a self hosted appointment scheduler.CVE-2026-23622 · Other software · alextselegidis · reported by GitHubHigh 7.4
Easy!Appointments is a self hosted appointment scheduler. In 1.5.2 and earlier, application/core/EA_Security.php::csrf_verify() only enforces CSRF for POST requests and returns early for non-POST methods. Several application endpoints perform state-changing operations while accepting parameters from GET (or $_REQUEST), so an attacker can perform CSRF by forcing a victim's browser to issue a crafted GET request. Impact: creation of admin accounts, modification of admin email/password, and full admin account takeover.
- Product
- easyappointments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2025alextselegidis Easy!Appointments v1.5.1 was discovered to contain a SQL injection vulnerability via the order_by parameter.CVE-2025-50383 · Other software · Easyappointments · reported by MITREHigh 8.1
alextselegidis Easy!Appointments v1.5.1 was discovered to contain a SQL injection vulnerability via the order_by parameter.
- Product
- Easy!appointments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordeasyappointments.orggithub.com
May 7, 2025Booking logic flaw in Easy!Appointments v1.5.1 allows unauthenticated attackers to create appointments with excessively long durations, causing a denial of servCVE-2025-29448 · Other software · Easyappointments · reported by MITREHigh 7.5
Booking logic flaw in Easy!Appointments v1.5.1 allows unauthenticated attackers to create appointments with excessively long durations, causing a denial of service by blocking all future booking availability.
- Product
- Easy!appointments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025An issue in Alex Tselegidis EasyAppointments v.1.5.0 allows a remote attacker to escalate privileges via the index.php file.CVE-2024-57602 · Other software · Easyappointments · reported by MITRECritical 9.8
An issue in Alex Tselegidis EasyAppointments v.1.5.0 allows a remote attacker to escalate privileges via the index.php file.
- Product
- Easyappointments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025Cross Site Scripting vulnerability in Alex Tselegidis EasyAppointments v.1.5.0 allows a remote attacker to execute arbitrary code via the legal_settings parametCVE-2024-57601 · Other software · Easyappointments · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in Alex Tselegidis EasyAppointments v.1.5.0 allows a remote attacker to execute arbitrary code via the legal_settings parameter.
- Product
- Easyappointments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2024A BOLA vulnerability in POST /customers allows a low privileged user to create a low privileged user (customer) in the system.CVE-2023-3290 · Other software · alextselegidis · reported by psirt@paloaltonetworks.comMedium 5
A BOLA vulnerability in POST /customers allows a low privileged user to create a low privileged user (customer) in the system. This results in unauthorized data manipulation.
- Product
- easyappointments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2024A BOLA vulnerability in POST /services allows a low privileged user to create a service for any user in the system (including admin).CVE-2023-3289 · Other software · easyappointments · reported by psirt@paloaltonetworks.comHigh 7.7
A BOLA vulnerability in POST /services allows a low privileged user to create a service for any user in the system (including admin). This results in unauthorized data manipulation.
- Product
- easyappointments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2024A BOLA vulnerability in POST /providers allows a low privileged user to create a privileged user (provider) in the system.CVE-2023-3288 · Other software · Easyappointments · reported by psirt@paloaltonetworks.comHigh 8.5
A BOLA vulnerability in POST /providers allows a low privileged user to create a privileged user (provider) in the system. This results in privilege escalation.
- Product
- Easyappointments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2024A BOLA vulnerability in POST /admins allows a low privileged user to create a high privileged user (admin) in the system.CVE-2023-3287 · Other software · easyappointments · reported by psirt@paloaltonetworks.comCritical 9.9
A BOLA vulnerability in POST /admins allows a low privileged user to create a high privileged user (admin) in the system. This results in privilege escalation.
- Product
- easyappointments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2024A BOLA vulnerability in POST /secretaries allows a low privileged user to create a low privileged user (secretary) in the system.CVE-2023-3286 · Other software · Easyappointments · reported by psirt@paloaltonetworks.comHigh 7.7
A BOLA vulnerability in POST /secretaries allows a low privileged user to create a low privileged user (secretary) in the system. This results in unauthorized data manipulation.
- Product
- Easyappointments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2024A BOLA vulnerability in GET, PUT, DELETE /services/{serviceId} allows a low privileged user to fetch, modify or delete the services of any user (including adminCVE-2023-38055 · Other software · easyappointments · reported by psirt@paloaltonetworks.comCritical 9.6
A BOLA vulnerability in GET, PUT, DELETE /services/{serviceId} allows a low privileged user to fetch, modify or delete the services of any user (including admin). This results in unauthorized access and unauthorized data manipulation.
- Product
- easyappointments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2024A BOLA vulnerability in GET, PUT, DELETE /customers/{customerId} allows a low privileged user to fetch, modify or delete a low privileged user (customer).CVE-2023-38054 · Other software · alextselegidis · reported by psirt@paloaltonetworks.comCritical 9.9
A BOLA vulnerability in GET, PUT, DELETE /customers/{customerId} allows a low privileged user to fetch, modify or delete a low privileged user (customer). This results in unauthorized access and unauthorized data manipulation.
- Product
- easyappointments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2024A BOLA vulnerability in GET, PUT, DELETE /settings/{settingName} allows a low privileged user to fetch, modify or delete the settings of any user (including admCVE-2023-38053 · Other software · easyappointments · reported by psirt@paloaltonetworks.comCritical 9.9
A BOLA vulnerability in GET, PUT, DELETE /settings/{settingName} allows a low privileged user to fetch, modify or delete the settings of any user (including admin). This results in unauthorized access and unauthorized data manipulation.
- Product
- easyappointments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2024A BOLA vulnerability in GET, PUT, DELETE /admins/{adminId} allows a low privileged user to fetch, modify or delete a high privileged user (admin).CVE-2023-38052 · Other software · easyappointments · reported by psirt@paloaltonetworks.comCritical 9.9
A BOLA vulnerability in GET, PUT, DELETE /admins/{adminId} allows a low privileged user to fetch, modify or delete a high privileged user (admin). This results in unauthorized access and unauthorized data manipulation.
- Product
- easyappointments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2024A BOLA vulnerability in GET, PUT, DELETE /secretaries/{secretaryId} allows a low privileged user to fetch, modify or delete a low privileged user (secretary).CVE-2023-38051 · Other software · easyappointments · reported by psirt@paloaltonetworks.comCritical 9.9
A BOLA vulnerability in GET, PUT, DELETE /secretaries/{secretaryId} allows a low privileged user to fetch, modify or delete a low privileged user (secretary). This results in unauthorized access and unauthorized data manipulation.
- Product
- easyappointments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2024A BOLA vulnerability in GET, PUT, DELETE /webhooks/{webhookId} allows a low privileged user to fetch, modify or delete a webhook of any user (including admin).CVE-2023-38050 · Other software · Easyappointments · reported by psirt@paloaltonetworks.comCritical 9.1
A BOLA vulnerability in GET, PUT, DELETE /webhooks/{webhookId} allows a low privileged user to fetch, modify or delete a webhook of any user (including admin). This results in unauthorized access and unauthorized data manipulation.
- Product
- Easyappointments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2024A BOLA vulnerability in GET, PUT, DELETE /appointments/{appointmentId} allows a low privileged user to fetch, modify or delete an appointment of any user (incluCVE-2023-38049 · Other software · alextselegidis · reported by psirt@paloaltonetworks.comCritical 9.9
A BOLA vulnerability in GET, PUT, DELETE /appointments/{appointmentId} allows a low privileged user to fetch, modify or delete an appointment of any user (including admin). This results in unauthorized access and unauthorized data manipulation.
- Product
- easyappointments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2024A BOLA vulnerability in GET, PUT, DELETE /providers/{providerId} allows a low privileged user to fetch, modify or delete a privileged user (provider).CVE-2023-38048 · Other software · easyappointments · reported by psirt@paloaltonetworks.comCritical 9.9
A BOLA vulnerability in GET, PUT, DELETE /providers/{providerId} allows a low privileged user to fetch, modify or delete a privileged user (provider). This results in unauthorized access and unauthorized data manipulation.
- Product
- easyappointments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2024A BOLA vulnerability in GET, PUT, DELETE /categories/{categoryId} allows a low privileged user to fetch, modify or delete the category of any user (including adCVE-2023-38047 · Other software · Easyappointments · reported by psirt@paloaltonetworks.comHigh 8.5
A BOLA vulnerability in GET, PUT, DELETE /categories/{categoryId} allows a low privileged user to fetch, modify or delete the category of any user (including admin). This results in unauthorized access and unauthorized data manipulation.
- Product
- Easyappointments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2024A BOLA vulnerability in POST /appointments allows a low privileged user to create an appointment for any user in the system (including admin).CVE-2023-3285 · Other software · alextselegidis · reported by psirt@paloaltonetworks.comHigh 7.7
A BOLA vulnerability in POST /appointments allows a low privileged user to create an appointment for any user in the system (including admin). This results in unauthorized data manipulation.
- Product
- easyappointments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2023Authorization Bypass Through User-Controlled Key in GitHub repository alextselegidis/easyappointments prior to 1.5.0.CVE-2023-3700 · Other software · alextselegidis · reported by security@huntr.devMedium 6.3
Authorization Bypass Through User-Controlled Key in GitHub repository alextselegidis/easyappointments prior to 1.5.0.
- Product
- alextselegidis/easyappointments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2023Open Redirect in GitHub repository alextselegidis/easyappointments prior to 1.5.0.CVE-2023-3568 · Other software · alextselegidis · reported by security@huntr.devMedium 6.3
Open Redirect in GitHub repository alextselegidis/easyappointments prior to 1.5.0.
- Product
- alextselegidis/easyappointments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2023Session Fixation in GitHub repository alextselegidis/easyappointments prior to 1.5.0.CVE-2023-2105 · Other software · alextselegidis · reported by security@huntr.devHigh 8.8
Session Fixation in GitHub repository alextselegidis/easyappointments prior to 1.5.0.
- Product
- alextselegidis/easyappointments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2023Improper Access Control in GitHub repository alextselegidis/easyappointments prior to 1.5.0.CVE-2023-2104 · Other software · alextselegidis · reported by security@huntr.devMedium 5.4
Improper Access Control in GitHub repository alextselegidis/easyappointments prior to 1.5.0.
- Product
- alextselegidis/easyappointments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2023Cross-site Scripting (XSS) - Stored in GitHub repository alextselegidis/easyappointments prior to 1.5.0.CVE-2023-2103 · Other software · alextselegidis · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository alextselegidis/easyappointments prior to 1.5.0.
- Product
- alextselegidis/easyappointments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2023Cross-site Scripting (XSS) - Stored in GitHub repository alextselegidis/easyappointments prior to 1.5.0.CVE-2023-2102 · Other software · alextselegidis · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Stored in GitHub repository alextselegidis/easyappointments prior to 1.5.0.
- Product
- alextselegidis/easyappointments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2023Code Injection in GitHub repository alextselegidis/easyappointments prior to 1.5.0.CVE-2023-1367 · Other software · alextselegidis · reported by security@huntr.devLow 3.8
Code Injection in GitHub repository alextselegidis/easyappointments prior to 1.5.0.
- Product
- alextselegidis/easyappointments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 8, 2023Use of Hard-coded Credentials in GitHub repository alextselegidis/easyappointments prior to 1.5.0.CVE-2023-1269 · Other software · alextselegidis · reported by security@huntr.devCritical 9.8
Use of Hard-coded Credentials in GitHub repository alextselegidis/easyappointments prior to 1.5.0.
- Product
- alextselegidis/easyappointments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2022API Privilege Escalation in GitHub repository alextselegidis/easyappointments prior to 1.5.0.CVE-2022-1397 · Other software · alextselegidis · reported by security@huntr.devHigh 8.8
API Privilege Escalation in GitHub repository alextselegidis/easyappointments prior to 1.5.0. Full system takeover.
- Product
- alextselegidis/easyappointments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2022Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository alextselegidis/easyappointments prior to 1.4.3.CVE-2022-0482 · Other software · alextselegidis · reported by security@huntr.devCritical 9.1
Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository alextselegidis/easyappointments prior to 1.4.3.
- Product
- alextselegidis/easyappointments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Mar 16, 2020Easy!Appointments 1.3.0 has a Missing Authorization issue allowing retrieval of hashed passwords and salts.CVE-2018-13063 · Other software · Easyappointments · reported by MITREHigh 7.5
Easy!Appointments 1.3.0 has a Missing Authorization issue allowing retrieval of hashed passwords and salts.
- Product
- Easy!appointments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsysdream.comsysdream.com
Mar 16, 2020Easy!Appointments 1.3.0 has a Guessable CAPTCHA issue.CVE-2018-13060 · Other software · Easyappointments · reported by MITREMedium 6.5
Easy!Appointments 1.3.0 has a Guessable CAPTCHA issue.
- Product
- Easy!appointments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsysdream.comsysdream.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.