Vulnerabilities in alextselegidis
22 resultsCVE-2022-0482CRITICALExposure of Private Personal Information to an Unauthorized Actor in alextselegidis/easyappointmentsEPSS 43.7%CVE-2022-1397HIGHAPI Privilege Escalation in alextselegidis/easyappointmentsEPSS 1.2%CVE-2023-1269MEDIUMUse of Hard-coded Credentials in alextselegidis/easyappointmentsEPSS 0.7%CVE-2023-2105HIGHSession Fixation in alextselegidis/easyappointmentsEPSS 0.7%CVE-2023-2102MEDIUMCross-site Scripting (XSS) - Stored in alextselegidis/easyappointmentsEPSS 0.5%CVE-2023-2103MEDIUMCross-site Scripting (XSS) - Stored in alextselegidis/easyappointmentsEPSS 0.5%CVE-2026-52837MEDIUMEasy!Appointments has unauthenticated customer PII disclosure on booking reschedule pageEPSS 0.5%CVE-2023-2104MEDIUMImproper Access Control in alextselegidis/easyappointmentsEPSS 0.4%CVE-2023-3700MEDIUMAuthorization Bypass Through User-Controlled Key in alextselegidis/easyappointmentsEPSS 0.4%CVE-2023-3568MEDIUMOpen Redirect in alextselegidis/easyappointmentsEPSS 0.4%CVE-2023-1367MEDIUM Code Injection in alextselegidis/easyappointmentsEPSS 0.4%CVE-2026-73529MEDIUMPlainpad Missing Rate Limiting via POST /v1/sessionsEPSS 0.4%CVE-2024-0698MEDIUMEasy!Appointments <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2026-108758HIGHEasy!Appointments through 1.6.0 Authorization Bypass via booking/register EndpointEPSS 0.3%CVE-2026-42562HIGHPlainpad: Privilege Escalation via Writable Admin Field in Profile Update (Access Control)EPSS 0.3%CVE-2025-31828MEDIUMWordPress Easy!Appointments plugin <= 1.4.2 - Cross Site Request Forgery (CSRF) to Settings Change vulnerabilityEPSS 0.3%CVE-2026-52840LOWEasy!Appointments has server-side request forgery in CalDAV connection test that exposes the deployment's internal networkEPSS 0.2%CVE-2026-23622HIGHCSRF Protection Bypass: Sensitive endpoints accept GET requests, enabling admin account takeoverEPSS 0.2%CVE-2026-55651HIGHEasy!Appointments Vulnerable to Appointments Takeover via Excessive Data ExposureEPSS 0.2%CVE-2026-52838LOWEasy!Appointments disable_booking_message rendered as raw HTML on public booking page — Stored XSSEPSS 0.2%