PatchTheCVEeasyappointments vulnerabilities
Recent CVEs affecting easyappointments products. 20 tracked.
easyappointments has 20 tracked vulnerabilities, 10 critical. A fixed release or vendor patch exists for 16. Most recent: 2026-01-15. Highest priority: CVE-2024-57602 (score 59/100).
- CVE-2025-50383 HIGH 8.1 DOWNGRADE alextselegidis Easy!Appointments v1.5.1 was discovered to contain a SQL injection vulnerability via the order_
- CVE-2026-23622 HIGH 8.8 UPGRADE Easy!Appointments is a self hosted appointment scheduler
- CVE-2025-31828 MEDIUM 4.3 UPGRADE Cross-Site Request Forgery (CSRF) vulnerability in alextselegidis Easy!Appointments easyappointments allows Cr
- CVE-2025-29448 HIGH 7.5 DOWNGRADE Booking logic flaw in Easy!Appointments v1.5.1 allows unauthenticated attackers to create appointments with ex
- CVE-2024-57602 CRITICAL 9.8 DOWNGRADE An issue in Alex Tselegidis EasyAppointments v.1.5.0 allows a remote attacker to escalate privileges via the i
- CVE-2024-57601 MEDIUM 6.1 DOWNGRADE Cross Site Scripting vulnerability in Alex Tselegidis EasyAppointments v.1.5.0 allows a remote attacker to exe
- CVE-2023-3290 MEDIUM 5.0 UPGRADE A BOLA vulnerability in POST /customers allows a low privileged user to create a low privileged user (customer
- CVE-2023-3289 HIGH 7.7 UPGRADE A BOLA vulnerability in POST /services allows a low privileged user to create a service for any user in the sy
- CVE-2023-3288 HIGH 8.5 UPGRADE A BOLA vulnerability in POST /providers allows a low privileged user to create a privileged user (provider) in
- CVE-2023-3287 CRITICAL 9.9 UPGRADE A BOLA vulnerability in POST /admins allows a low privileged user to create a high privileged user (admin) in
- CVE-2023-3286 HIGH 7.7 UPGRADE A BOLA vulnerability in POST /secretaries allows a low privileged user to create a low privileged user (secret
- CVE-2023-38055 CRITICAL 9.6 UPGRADE A BOLA vulnerability in GET, PUT, DELETE /services/{serviceId} allows a low privileged user to fetch, modify o
- CVE-2023-38054 CRITICAL 9.9 UPGRADE A BOLA vulnerability in GET, PUT, DELETE /customers/{customerId} allows a low privileged user to fetch, modify
- CVE-2023-38053 CRITICAL 9.9 UPGRADE A BOLA vulnerability in GET, PUT, DELETE /settings/{settingName} allows a low privileged user to fetch, modify
- CVE-2023-38052 CRITICAL 9.9 UPGRADE A BOLA vulnerability in GET, PUT, DELETE /admins/{adminId} allows a low privileged user to fetch, modify or de
- CVE-2023-38051 CRITICAL 9.9 UPGRADE A BOLA vulnerability in GET, PUT, DELETE /secretaries/{secretaryId} allows a low privileged user to fetch, mod
- CVE-2023-38050 CRITICAL 9.1 UPGRADE A BOLA vulnerability in GET, PUT, DELETE /webhooks/{webhookId} allows a low privileged user to fetch, modify o
- CVE-2023-38049 CRITICAL 9.9 UPGRADE A BOLA vulnerability in GET, PUT, DELETE /appointments/{appointmentId} allows a low privileged user to fetch,
- CVE-2023-38048 CRITICAL 9.9 UPGRADE A BOLA vulnerability in GET, PUT, DELETE /providers/{providerId} allows a low privileged user to fetch, modify
- CVE-2023-38047 HIGH 8.5 UPGRADE A BOLA vulnerability in GET, PUT, DELETE /categories/{categoryId} allows a low privileged user to fetch, modif
FAQ
How do I fix easyappointments vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is easyappointments being exploited right now?
None of the tracked easyappointments CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which easyappointments CVE should I patch first?
CVE-2024-57602 currently ranks highest (59/100): An issue in Alex Tselegidis EasyAppointments v.1.5.0 allows a remote attacker to escalate privileges via the i.