Alextselegidis vulnerabilities
We track 8 vulnerabilities in Alextselegidis products across 3 products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on October 11, 2026.
Latest Alextselegidis vulnerabilities
- 8.2 High severity
easyappointments: Authorization Bypass Through User-Controlled Key
Easy!Appointments through 1.6.0 contains an authorization bypass vulnerability in Booking::register() that allows unauthenticated attackers to modify any appointment by supplying an appointment id without its hash. Attackers can enumerate sequential appointmen
- 7.1 High severity
easyappointments: Exposure of Sensitive Information to an Unauthorized Actor
Easy!Appointments is a self hosted appointment scheduler. In version 1.5.2, an Excessive Data Exposure vulnerability in the customers search endpoint allows an authenticated user to obtain appointment hashes belonging to other users. Using these hashes, an att
- 8.3 High severity
plainpad: Improper Privilege Management
Plainpad is a self hosted note taking app. Prior to version 1.1.1, Plainpad allows a low-privilege authenticated user to self-escalate to administrator by submitting admin=true in PUT /api.php/v1/users/{id}. The endpoint directly persists the admin attribute f
- 8.8 High severity
easyappointments: Cross-Site Request Forgery
Easy!Appointments is a self hosted appointment scheduler. In 1.5.2 and earlier, application/core/EA_Security.php::csrf_verify() only enforces CSRF for POST requests and returns early for non-POST methods. Several application endpoints perform state-changing op
- 8.8 High severity
Easy!Appointments: Cross-Site Request Forgery
Cross-Site Request Forgery (CSRF) vulnerability in alextselegidis Easy!Appointments easyappointments allows Cross Site Request Forgery.This issue affects Easy!Appointments: from n/a through <= 1.4.2.
- 8.1 High severity
easyappointments: Authorization Bypass Through User-Controlled Key
A BOLA vulnerability in GET, PUT, DELETE /customers/{customerId} allows a low privileged user to fetch, modify or delete a low privileged user (customer). This results in unauthorized access and unauthorized data manipulation.
- 8.1 High severity
easyappointments: Authorization Bypass Through User-Controlled Key
A BOLA vulnerability in GET, PUT, DELETE /appointments/{appointmentId} allows a low privileged user to fetch, modify or delete an appointment of any user (including admin). This results in unauthorized access and unauthorized data manipulation.
- 7.7 High severity
easyappointments: Authorization Bypass Through User-Controlled Key
A BOLA vulnerability in POST /appointments allows a low privileged user to create an appointment for any user in the system (including admin). This results in unauthorized data manipulation.