Easy!Appointments
Approved changes feed: RSS · Atom
cpe:2.3:a:easyappointments:easy\!appointments:*:*:*:*:*:-:*:*
part: a version: * update: *
| Vendor | Easyappointments (93e21748-e17c-514a-960d-8a5278057e61) |
|---|---|
| Product | Easy!Appointments (ebb160bb-ddfd-54cd-aebf-8f39025de22c) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | - |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-23622 |
vulnerable | 2026-06-08 07:51:15.682887 |
CSRF Protection Bypass: Sensitive endpoints accept GET requests, enabling admin account takeover
Easy!Appointments is a self hosted appointment scheduler. In 1.5.2 and earlier, application/core/EA_Security.php::csrf_verify() only enforces CSRF for POST requests and returns early for non-POST methods. Several application endpoints perform state-changing operations while accepting parameters from GET (or $_REQUEST), so an attacker can perform CSRF by forcing a victim's browser to issue a crafted GET request. Impact: creation of admin accounts, modification of admin email/password, and full admin account takeover.
Published: 2026-01-15T19:28:58.369Z
Updated: 2026-01-15T21:34:43.098Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.