easyappointments vulnerabilities
6 known vulnerabilities in easyappointments from Alextselegidis. 6 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.2 High severity
easyappointments: Authorization Bypass Through User-Controlled Key
Easy!Appointments through 1.6.0 contains an authorization bypass vulnerability in Booking::register() that allows unauthenticated attackers to modify any appointment by supplying an appointment id without its hash. Attackers can enumerate sequential appointmen
- 7.1 High severity
easyappointments: Exposure of Sensitive Information to an Unauthorized Actor
Easy!Appointments is a self hosted appointment scheduler. In version 1.5.2, an Excessive Data Exposure vulnerability in the customers search endpoint allows an authenticated user to obtain appointment hashes belonging to other users. Using these hashes, an att
- 8.8 High severity
easyappointments: Cross-Site Request Forgery
Easy!Appointments is a self hosted appointment scheduler. In 1.5.2 and earlier, application/core/EA_Security.php::csrf_verify() only enforces CSRF for POST requests and returns early for non-POST methods. Several application endpoints perform state-changing op
- 8.1 High severity
easyappointments: Authorization Bypass Through User-Controlled Key
A BOLA vulnerability in GET, PUT, DELETE /customers/{customerId} allows a low privileged user to fetch, modify or delete a low privileged user (customer). This results in unauthorized access and unauthorized data manipulation.
- 8.1 High severity
easyappointments: Authorization Bypass Through User-Controlled Key
A BOLA vulnerability in GET, PUT, DELETE /appointments/{appointmentId} allows a low privileged user to fetch, modify or delete an appointment of any user (including admin). This results in unauthorized access and unauthorized data manipulation.
- 7.7 High severity
easyappointments: Authorization Bypass Through User-Controlled Key
A BOLA vulnerability in POST /appointments allows a low privileged user to create an appointment for any user in the system (including admin). This results in unauthorized data manipulation.