EA
Product
Easyappointments
26
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 13Medium 9Low 1
Watch
Add Easyappointments to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-57602 | 9.8 | Feb 12 | An issue in Alex Tselegidis EasyAppointments v.1.5.0 allows a remote attacker to escalate privileges via the index.php file Affected: 1.5.0 |
| CVE-2023-1269 | 9.8 | Mar 8 | Use of Hard-coded Credentials in alextselegidis/easyappointments Affected: before 1.5.0 |
| CVE-2022-0482 | 9.1 | Mar 9 | Exposure of Private Personal Information to an Unauthorized Actor in alextselegidis/easyappointments Affected: before 1.4.3 |
| CVE-2023-3288 | 8.8 | Jul 9 | A BOLA vulnerability in POST /providers in EasyAppointments < 1.5.0 Affected: before 1.5.0 |
| CVE-2023-3287 | 8.8 | Jul 9 | A BOLA vulnerability in POST /admins in EasyAppointments < 1.5.0 Affected: before 1.5.0 |
| CVE-2023-2105 | 8.8 | Apr 15 | Session Fixation in alextselegidis/easyappointments Affected: before 1.5.0 |
| CVE-2022-1397 | 8.8 | May 10 | API Privilege Escalation in alextselegidis/easyappointments Affected: before 1.5.0 |
| CVE-2023-38055 | 8.1 | Jul 9 | A BOLA vulnerability in GET, PUT, DELETE /services/{serviceId} in EasyAppointments < 1.5.0 Affected: before 1.5.0 |
| CVE-2023-38054 | 8.1 | Jul 9 | A BOLA vulnerability in GET, PUT, DELETE /customers/{customerId} in EasyAppointments < 1.5.0 Affected: before 1.5.0 |
| CVE-2023-38053 | 8.1 | Jul 9 | A BOLA vulnerability in GET, PUT, DELETE /settings/{settingName} in EasyAppointments < 1.5.0 Affected: before 1.5.0 |
| CVE-2023-38052 | 8.1 | Jul 9 | A BOLA vulnerability in GET, PUT, DELETE /admins/{adminId} in EasyAppointments < 1.5.0 Affected: before 1.5.0 |
| CVE-2023-38051 | 8.1 | Jul 9 | A BOLA vulnerability in GET, PUT, DELETE /secretaries/{secretaryId} in EasyAppointments < 1.5.0 Affected: before 1.5.0 |
| CVE-2023-38050 | 8.1 | Jul 9 | A BOLA vulnerability in GET, PUT, DELETE /webhooks/{webhookId} in EasyAppointments < 1.5.0 Affected: before 1.5.0 |
| CVE-2023-38049 | 8.1 | Jul 9 | A BOLA vulnerability in GET, PUT, DELETE /appointments/{appointmentId} in EasyAppointments < 1.5.0 Affected: before 1.5.0 |
| CVE-2023-38048 | 8.1 | Jul 9 | A BOLA vulnerability in GET, PUT, DELETE /providers/{providerId} in EasyAppointments < 1.5.0 Affected: before 1.5.0 |
| CVE-2023-38047 | 8.1 | Jul 9 | A BOLA vulnerability in GET, PUT, DELETE /categories/{categoryId} in EasyAppointments < 1.5.0. Affected: before 1.5.0 |
| CVE-2023-3289 | 6.5 | Jul 9 | A BOLA vulnerability in POST /services in EasyAppointments < 1.5.0 Affected: before 1.5.0 |
| CVE-2023-3286 | 6.5 | Jul 9 | A BOLA vulnerability in POST /secretaries in EasyAppointments < 1.5.0 Affected: before 1.5.0 |
| CVE-2024-57601 | 6.1 | Feb 12 | Cross Site Scripting vulnerability in Alex Tselegidis EasyAppointments v.1.5.0 allows a remote attacker to execute arbitrary code via the legal_settings parameter Affected: 1.5.0 |
| CVE-2023-2104 | 5.4 | Apr 15 | Improper Access Control in alextselegidis/easyappointments Affected: before 1.5.0 |
| CVE-2023-2103 | 5.4 | Apr 15 | Cross-site Scripting (XSS) - Stored in alextselegidis/easyappointments Affected: before 1.5.0 |
| CVE-2023-3290 | 5.0 | Jul 9 | A BOLA vulnerability in POST /customers in EasyAppointments < 1.5.0 Affected: before 1.5.0 |
| CVE-2023-2102 | 4.8 | Apr 15 | Cross-site Scripting (XSS) - Stored in alextselegidis/easyappointments Affected: before 1.5.0 |
| CVE-2024-2844 | 4.3 | Mar 29 | Easy Appointments <= 3.11.18 - Insufficient Authorization Affected: through 3.11.18 |
| CVE-2023-3700 | 4.3 | Jul 17 | Authorization Bypass Through User-Controlled Key in alextselegidis/easyappointments Affected: before 1.5.0 |
| CVE-2023-1367 | 3.8 | Mar 13 | Code Injection in alextselegidis/easyappointments Affected: before 1.5.0 |
Showing 26