- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 20 · 2 critical, 5 high, 9 medium, 4 low
- Registry
- Packagist
Advisories 20
- CVE-2026-55651High 7.1
Easy!Appointments Vulnerable to Appointments Takeover via Excessive Data Exposure
Affected: versions 1.5.2.
- CVE-2026-52841Low 3.1
Easy!Appointments: Authorization bypass in Google OAuth provider binding lets any backend user rebind a peer provider's Google sync
Affected: through 1.5.2.
- CVE-2026-52840Low 2.7
Easy!Appointments has server-side request forgery in CalDAV connection test that exposes the deployment's internal network
Affected: through 1.5.2.
- CVE-2026-52839Low 3.3
Easy!Appointments appointments/store and appointments/update allow cross-provider appointment injection — Authorization Bypass
Affected: fixed in 1.6.0.
- CVE-2026-52838Low 2.6
Easy!Appointments disable_booking_message rendered as raw HTML on public booking page — Stored XSS
Affected: through 1.5.2.
- CVE-2026-52837Medium 6.9
Easy!Appointments has unauthenticated customer PII disclosure on booking reschedule page
Affected: through 1.5.2.
- CVE-2026-23622High 7.4
CSRF Protection Bypass: Sensitive endpoints accept GET requests, enabling admin account takeover
Affected: through 1.5.2.
- CVE-2025-50383High 8.1
alextselegidis Easy!Appointments v1.5.1 was discovered to contain a SQL injection vulnerability via the order_by parameter.
Affected: fixed in 1.5.2-beta.1.
- CVE-2025-29448High 7.5
Booking logic flaw in Easy!Appointments v1.5.1 allows unauthenticated attackers to create appointments with excessively long durations…
Affected: through 1.5.1.
- CVE-2024-57602Critical 9.8
An issue in Alex Tselegidis EasyAppointments v.1.5.0 allows a remote attacker to escalate privileges via the index.php file.
Affected: through 1.5.0.
- CVE-2024-57601Medium 6.1
Cross Site Scripting vulnerability in Alex Tselegidis EasyAppointments v.1.5.0 allows a remote attacker to execute arbitrary code via the…
Affected: through 1.5.0.
- CVE-2023-3700Medium 6.3
Authorization Bypass Through User-Controlled Key in alextselegidis/easyappointments
Affected: fixed in 1.5.0.
- CVE-2023-2105Medium 5.4
Session Fixation in alextselegidis/easyappointments
Affected: through 1.4.3.
- CVE-2023-2104Medium 5.4
Improper Access Control in alextselegidis/easyappointments
Affected: through 1.4.3.
- CVE-2023-2103Medium 4.3
Cross-site Scripting (XSS) - Stored in alextselegidis/easyappointments
Affected: through 1.4.3.
Show all 20 advisoriesShow fewer advisories
- CVE-2023-2102Medium 6.8
Cross-site Scripting (XSS) - Stored in alextselegidis/easyappointments
Affected: through 1.4.3.
- CVE-2023-1367Medium 6.0
Code Injection in alextselegidis/easyappointments
Affected: fixed in 1.5.0.
- CVE-2023-1269Medium 6.5
Use of Hard-coded Credentials in alextselegidis/easyappointments
Affected: through 1.4.3.
- CVE-2022-1397High 8.8
API Privilege Escalation in alextselegidis/easyappointments
Affected: through 1.4.3.
- CVE-2022-0482Critical 9.1
Exposure of Private Personal Information to an Unauthorized Actor in alextselegidis/easyappointments
Affected: fixed in 1.4.3.