AL
Vendor
alextselegidis
27
CVEs
0
On KEV
1
New 30D
Products
EA8.8
easyappointments
alextselegidis
13 CVEs0 on KEV1 new
AL9.8
alextselegidis/easyappointments
alextselegidis
10 CVEs0 on KEV0 new
EA8.8
Easy!Appointments
alextselegidis
2 CVEs0 on KEV0 new
PL8.3
plainpad
alextselegidis
2 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-108758 | EA easyappointments alextselegidis | 8.2 | Oct 11 | Easy!Appointments through 1.6.0 Authorization Bypass via booking/register Endpoint |
| CVE-2026-73529 | PL plainpad alextselegidis | 5.3 | Aug 18 | Plainpad Missing Rate Limiting via POST /v1/sessions |
| CVE-2026-55651 | EA easyappointments alextselegidis | 7.1 | Jul 14 | Easy!Appointments Vulnerable to Appointments Takeover via Excessive Data Exposure |
| CVE-2026-52841 | EA easyappointments alextselegidis | 3.1 | Jul 14 | Easy!Appointments: Authorization bypass in Google OAuth provider binding lets any backend user rebind a peer provider's Google sync |
| CVE-2026-52840 | EA easyappointments alextselegidis | 2.7 | Jul 14 | Easy!Appointments has server-side request forgery in CalDAV connection test that exposes the deployment's internal network |
| CVE-2026-52839 | EA easyappointments alextselegidis | 3.3 | Jul 14 | Easy!Appointments appointments/store and appointments/update allow cross-provider appointment injection — Authorization Bypass |
| CVE-2026-52838 | EA easyappointments alextselegidis | 2.6 | Jul 14 | Easy!Appointments disable_booking_message rendered as raw HTML on public booking page — Stored XSS |
| CVE-2026-52837 | EA easyappointments alextselegidis | 6.9 | Jul 14 | Easy!Appointments has unauthenticated customer PII disclosure on booking reschedule page |
| CVE-2026-42562 | PL plainpad alextselegidis | 8.3 | May 9 | Plainpad: Privilege Escalation via Writable Admin Field in Profile Update (Access Control) |
| CVE-2026-23622 | EA easyappointments alextselegidis | 8.8 | Jan 15 | CSRF Protection Bypass: Sensitive endpoints accept GET requests, enabling admin account takeover |
| CVE-2025-31828 | EA Easy!Appointments alextselegidis | 8.8 | Apr 1 | WordPress Easy!Appointments plugin <= 1.4.2 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability |
| CVE-2023-38054 | EA Easyappointments Alextselegidis | 8.1 | Jul 9 | A BOLA vulnerability in GET, PUT, DELETE /customers/{customerId} in EasyAppointments < 1.5.0 |
| CVE-2023-38049 | EA Easyappointments Alextselegidis | 8.1 | Jul 9 | A BOLA vulnerability in GET, PUT, DELETE /appointments/{appointmentId} in EasyAppointments < 1.5.0 |
| CVE-2023-3290 | EA Easyappointments Alextselegidis | 5.0 | Jul 9 | A BOLA vulnerability in POST /customers in EasyAppointments < 1.5.0 |
| CVE-2023-3285 | EA Easyappointments Alextselegidis | 7.7 | Jul 9 | A BOLA vulnerability in POST /appointments in EasyAppointments < 1.5.0 |
| CVE-2024-0698 | EA Easy!Appointments alextselegidis | 5.4 | Mar 5 | Easy!Appointments <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting |
| CVE-2023-3700 | AL alextselegidis/easyappointments alextselegidis | 4.3 | Jul 17 | Authorization Bypass Through User-Controlled Key in alextselegidis/easyappointments |
| CVE-2023-3568 | AL alextselegidis/easyappointments alextselegidis | 4.8 | Jul 10 | Open Redirect in alextselegidis/easyappointments |
| CVE-2023-2103 | AL alextselegidis/easyappointments alextselegidis | 5.4 | Apr 15 | Cross-site Scripting (XSS) - Stored in alextselegidis/easyappointments |
| CVE-2023-2105 | AL alextselegidis/easyappointments alextselegidis | 8.8 | Apr 15 | Session Fixation in alextselegidis/easyappointments |
| CVE-2023-2104 | AL alextselegidis/easyappointments alextselegidis | 5.4 | Apr 15 | Improper Access Control in alextselegidis/easyappointments |
| CVE-2023-2102 | AL alextselegidis/easyappointments alextselegidis | 4.8 | Apr 15 | Cross-site Scripting (XSS) - Stored in alextselegidis/easyappointments |
| CVE-2023-1367 | AL alextselegidis/easyappointments alextselegidis | 3.8 | Mar 13 | Code Injection in alextselegidis/easyappointments |
| CVE-2023-1269 | AL alextselegidis/easyappointments alextselegidis | 9.8 | Mar 8 | Use of Hard-coded Credentials in alextselegidis/easyappointments |
| CVE-2022-1397 | AL alextselegidis/easyappointments alextselegidis | 8.8 | May 10 | API Privilege Escalation in alextselegidis/easyappointments |
| CVE-2022-0482 | AL alextselegidis/easyappointments alextselegidis | 9.1 | Mar 9 | Exposure of Private Personal Information to an Unauthorized Actor in alextselegidis/easyappointments |