alextselegidis/easyappointments vulnerabilities (Packagist)
20 vulnerabilities.
alextselegidis/easyappointmentsPackagistEasy!Appointments Vulnerable to Appointments Takeover via Excessive Data Exposure7.1 Highalextselegidis/easyappointmentsPackagistEasy!Appointments: Authorization bypass in Google OAuth provider binding lets any backend user rebind a peer provider's Google sync3.1 Lowalextselegidis/easyappointmentsPackagistEasy!Appointments has server-side request forgery in CalDAV connection test that exposes the deployment's internal network2.7 Lowalextselegidis/easyappointmentsPackagistEasy!Appointments appointments/store and appointments/update allow cross-provider appointment injection — Authorization Bypass3.3 Lowalextselegidis/easyappointmentsPackagistEasy!Appointments disable_booking_message rendered as raw HTML on public booking page — Stored XSS2.6 Lowalextselegidis/easyappointmentsPackagistEasy!Appointments has unauthenticated customer PII disclosure on booking reschedule page6.9 Mediumalextselegidis/easyappointmentsPackagistCSRF Protection Bypass: Sensitive endpoints accept GET requests, enabling admin account takeover7.4 Highalextselegidis/easyappointmentsPackagistEasy!Appointments SQL injection vulnerability8.1 Highalextselegidis/easyappointmentsPackagistEasy!Appointments Denial of Service (DoS)7.5 Highalextselegidis/easyappointmentsPackagistEasy!Appointments Improper Restriction of Excessive Authentication Attempts9.8 Criticalalextselegidis/easyappointmentsPackagistRemote code execution in alextselegidis/easyappointments6.1 Mediumalextselegidis/easyappointmentsPackagistAuthorization Bypass Through User-Controlled Key in alextselegidis/easyappointments6.3 Mediumalextselegidis/easyappointmentsPackagistSession Fixation in alextselegidis/easyappointments5.4 Mediumalextselegidis/easyappointmentsPackagistImproper Access Control in alextselegidis/easyappointments5.4 Mediumalextselegidis/easyappointmentsPackagistCross-site Scripting (XSS) - Stored in alextselegidis/easyappointments4.3 Mediumalextselegidis/easyappointmentsPackagistCross-site Scripting (XSS) - Stored in alextselegidis/easyappointments6.8 Mediumalextselegidis/easyappointmentsPackagistCode Injection in alextselegidis/easyappointments6.0 Mediumalextselegidis/easyappointmentsPackagistUse of Hard-coded Credentials in alextselegidis/easyappointments6.5 Mediumalextselegidis/easyappointmentsPackagistAPI Privilege Escalation in alextselegidis/easyappointments8.8 Highalextselegidis/easyappointmentsPackagistExposure of Private Personal Information to an Unauthorized Actor in alextselegidis/easyappointments9.1 Critical