alextselegidis vulnerabilities

CVEs per yearBy the year they were published

1. 20222
2. 20238
3. 20241
4. 20251
5. 202610

Newest CVEs

• CVE-2026-108758

  Easy!Appointments through 1.6.0 Authorization Bypass via booking/register Endpoint

  alextselegidis · easyappointments

  High8.8
• CVE-2026-73529

  Plainpad Missing Rate Limiting via POST /v1/sessions

  alextselegidis · plainpad

  Medium6.9
• CVE-2026-55651

  Easy!Appointments Vulnerable to Appointments Takeover via Excessive Data Exposure

  alextselegidis · easyappointments

  High7.1
• CVE-2026-52841

  Easy!Appointments: Authorization bypass in Google OAuth provider binding lets any backend user rebind a peer provider's Google sync

  alextselegidis · easyappointments

  Low3.1
• CVE-2026-52840

  Easy!Appointments has server-side request forgery in CalDAV connection test that exposes the deployment's internal network

  alextselegidis · easyappointments

  Low2.7
• CVE-2026-52839

  Easy!Appointments appointments/store and appointments/update allow cross-provider appointment injection — Authorization Bypass

  alextselegidis · easyappointments

  Low3.3
• CVE-2026-52838

  Easy!Appointments disable_booking_message rendered as raw HTML on public booking page — Stored XSS

  alextselegidis · easyappointments

  Low2.6
• CVE-2026-52837

  Easy!Appointments has unauthenticated customer PII disclosure on booking reschedule page

  alextselegidis · easyappointments

  Medium6.9
• CVE-2026-42562

  Plainpad: Privilege Escalation via Writable Admin Field in Profile Update (Access Control)

  alextselegidis · plainpad

  High8.3
• CVE-2026-23622

  CSRF Protection Bypass: Sensitive endpoints accept GET requests, enabling admin account takeover

  alextselegidis · easyappointments

  High7.4