# alextselegidis/easyappointments (Packagist) vulnerabilities

20 known vulnerabilities (2 critical, 5 high, 9 medium, 4 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://packagist.org/packages/alextselegidis/easyappointments

## Advisories (20)

### [CVE-2026-55651](https://cve.now/CVE-2026-55651): Easy!Appointments Vulnerable to Appointments Takeover via Excessive Data Exposure

- Severity: High 7.1
- Published: Jul 14, 2026
- Affected: versions 1.5.2.

### [CVE-2026-52841](https://cve.now/CVE-2026-52841): Easy!Appointments: Authorization bypass in Google OAuth provider binding lets any backend user rebind a peer provider's Google sync

- Severity: Low 3.1
- Published: Jul 14, 2026
- Affected: through 1.5.2.

### [CVE-2026-52840](https://cve.now/CVE-2026-52840): Easy!Appointments has server-side request forgery in CalDAV connection test that exposes the deployment's internal network

- Severity: Low 2.7
- Published: Jul 14, 2026
- Affected: through 1.5.2.

### [CVE-2026-52839](https://cve.now/CVE-2026-52839): Easy!Appointments appointments/store and appointments/update allow cross-provider appointment injection — Authorization Bypass

- Severity: Low 3.3
- Published: Jul 14, 2026
- Affected: fixed in 1.6.0.

### [CVE-2026-52838](https://cve.now/CVE-2026-52838): Easy!Appointments disable\_booking\_message rendered as raw HTML on public booking page — Stored XSS

- Severity: Low 2.6
- Published: Jul 14, 2026
- Affected: through 1.5.2.

### [CVE-2026-52837](https://cve.now/CVE-2026-52837): Easy!Appointments has unauthenticated customer PII disclosure on booking reschedule page

- Severity: Medium 6.9
- Published: Jul 14, 2026
- Affected: through 1.5.2.

### [CVE-2026-23622](https://cve.now/CVE-2026-23622): CSRF Protection Bypass: Sensitive endpoints accept GET requests, enabling admin account takeover

- Severity: High 7.4
- Published: Jan 15, 2026
- Affected: through 1.5.2.

### [CVE-2025-50383](https://cve.now/CVE-2025-50383): alextselegidis Easy!Appointments v1.5.1 was discovered to contain a SQL injection vulnerability via the order\_by parameter.

- Severity: High 8.1
- Published: Aug 25, 2025
- Affected: fixed in 1.5.2-beta.1.

### [CVE-2025-29448](https://cve.now/CVE-2025-29448): Booking logic flaw in Easy!Appointments v1.5.1 allows unauthenticated attackers to create appointments with excessively long durations…

- Severity: High 7.5
- Published: May 7, 2025
- Affected: through 1.5.1.

### [CVE-2024-57602](https://cve.now/CVE-2024-57602): An issue in Alex Tselegidis EasyAppointments v.1.5.0 allows a remote attacker to escalate privileges via the index.php file.

- Severity: Critical 9.8
- Published: Feb 12, 2025
- Affected: through 1.5.0.

### [CVE-2024-57601](https://cve.now/CVE-2024-57601): Cross Site Scripting vulnerability in Alex Tselegidis EasyAppointments v.1.5.0 allows a remote attacker to execute arbitrary code via the…

- Severity: Medium 6.1
- Published: Feb 12, 2025
- Affected: through 1.5.0.

### [CVE-2023-3700](https://cve.now/CVE-2023-3700): Authorization Bypass Through User-Controlled Key in alextselegidis/easyappointments

- Severity: Medium 6.3
- Published: Jul 17, 2023
- Affected: fixed in 1.5.0.

### [CVE-2023-2105](https://cve.now/CVE-2023-2105): Session Fixation in alextselegidis/easyappointments

- Severity: Medium 5.4
- Published: Apr 15, 2023
- Affected: through 1.4.3.

### [CVE-2023-2104](https://cve.now/CVE-2023-2104): Improper Access Control in alextselegidis/easyappointments

- Severity: Medium 5.4
- Published: Apr 15, 2023
- Affected: through 1.4.3.

### [CVE-2023-2103](https://cve.now/CVE-2023-2103): Cross-site Scripting (XSS) - Stored in alextselegidis/easyappointments

- Severity: Medium 4.3
- Published: Apr 15, 2023
- Affected: through 1.4.3.

### [CVE-2023-2102](https://cve.now/CVE-2023-2102): Cross-site Scripting (XSS) - Stored in alextselegidis/easyappointments

- Severity: Medium 6.8
- Published: Apr 15, 2023
- Affected: through 1.4.3.

### [CVE-2023-1367](https://cve.now/CVE-2023-1367): Code Injection in alextselegidis/easyappointments

- Severity: Medium 6.0
- Published: Mar 13, 2023
- Affected: fixed in 1.5.0.

### [CVE-2023-1269](https://cve.now/CVE-2023-1269): Use of Hard-coded Credentials in alextselegidis/easyappointments

- Severity: Medium 6.5
- Published: Mar 8, 2023
- Affected: through 1.4.3.

### [CVE-2022-1397](https://cve.now/CVE-2022-1397): API Privilege Escalation in alextselegidis/easyappointments

- Severity: High 8.8
- Published: May 10, 2022
- Affected: through 1.4.3.

### [CVE-2022-0482](https://cve.now/CVE-2022-0482): Exposure of Private Personal Information to an Unauthorized Actor in alextselegidis/easyappointments

- Severity: Critical 9.1
- Published: Mar 9, 2022
- Affected: fixed in 1.4.3.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/packagist/alextselegidis/easyappointments
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.