EA
Product
easyappointments
13
CVEs
0
On KEV
8.8
Max CVSS
1
New 30D
Severity mix
Critical 0High 6Medium 3Low 4
Watch
Add easyappointments to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-23622 | 8.8 | Jan 15 | CSRF Protection Bypass: Sensitive endpoints accept GET requests, enabling admin account takeover Affected: <= 1.5.2 |
| CVE-2026-108758 | 8.2 | Oct 11 | Easy!Appointments through 1.6.0 Authorization Bypass via booking/register Endpoint Affected: through 1.6.0 |
| CVE-2023-38054 | 8.1 | Jul 9 | A BOLA vulnerability in GET, PUT, DELETE /customers/{customerId} in EasyAppointments < 1.5.0 Affected: before 1.5.0 |
| CVE-2023-38049 | 8.1 | Jul 9 | A BOLA vulnerability in GET, PUT, DELETE /appointments/{appointmentId} in EasyAppointments < 1.5.0 Affected: before 1.5.0 |
| CVE-2023-3285 | 7.7 | Jul 9 | A BOLA vulnerability in POST /appointments in EasyAppointments < 1.5.0 Affected: before 1.5.0 |
| CVE-2026-55651 | 7.1 | Jul 14 | Easy!Appointments Vulnerable to Appointments Takeover via Excessive Data Exposure Affected: = 1.5.2 |
| CVE-2026-52837 | 6.9 | Jul 14 | Easy!Appointments has unauthenticated customer PII disclosure on booking reschedule page Affected: < 1.6.0 |
| CVE-2023-3290 | 5.0 | Jul 9 | A BOLA vulnerability in POST /customers in EasyAppointments < 1.5.0 Affected: before 1.5.0 |
| CVE-2023-3568 | 4.8 | Jul 10 | Open Redirect in alextselegidis/easyappointments Affected: before 1.5.0 |
| CVE-2026-52839 | 3.3 | Jul 14 | Easy!Appointments appointments/store and appointments/update allow cross-provider appointment injection — Authorization Bypass Affected: < 1.6.0 |
| CVE-2026-52841 | 3.1 | Jul 14 | Easy!Appointments: Authorization bypass in Google OAuth provider binding lets any backend user rebind a peer provider's Google sync Affected: < 1.6.0 |
| CVE-2026-52840 | 2.7 | Jul 14 | Easy!Appointments has server-side request forgery in CalDAV connection test that exposes the deployment's internal network Affected: < 1.6.0 |
| CVE-2026-52838 | 2.6 | Jul 14 | Easy!Appointments disable_booking_message rendered as raw HTML on public booking page — Stored XSS Affected: < 1.6.0 |
Showing 13