Vulnerabilities > Easyappointments > Easyappointments > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2024-07-09 | CVE-2023-3286 | Authorization Bypass Through User-Controlled Key vulnerability in Easyappointments A BOLA vulnerability in POST /secretaries allows a low privileged user to create a low privileged user (secretary) in the system. | 6.5 |
| 2024-07-09 | CVE-2023-3289 | Authorization Bypass Through User-Controlled Key vulnerability in Easyappointments A BOLA vulnerability in POST /services allows a low privileged user to create a service for any user in the system (including admin). | 6.5 |
| 2024-07-09 | CVE-2023-3290 | Authorization Bypass Through User-Controlled Key vulnerability in Easyappointments A BOLA vulnerability in POST /customers allows a low privileged user to create a low privileged user (customer) in the system. | 5.0 |
| 2023-07-17 | CVE-2023-3700 | Authorization Bypass Through User-Controlled Key vulnerability in Easyappointments Authorization Bypass Through User-Controlled Key in GitHub repository alextselegidis/easyappointments prior to 1.5.0. | 4.3 |
| 2023-04-15 | CVE-2023-2103 | Cross-site Scripting vulnerability in Easyappointments Cross-site Scripting (XSS) - Stored in GitHub repository alextselegidis/easyappointments prior to 1.5.0. | 5.4 |
| 2023-04-15 | CVE-2023-2104 | Improper Access Control vulnerability in Easyappointments Improper Access Control in GitHub repository alextselegidis/easyappointments prior to 1.5.0. | 5.4 |
| 2023-04-15 | CVE-2023-2102 | Cross-site Scripting vulnerability in Easyappointments Cross-site Scripting (XSS) - Stored in GitHub repository alextselegidis/easyappointments prior to 1.5.0. | 4.8 |
| 2022-03-09 | CVE-2022-0482 | Privacy Violation vulnerability in Easyappointments Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository alextselegidis/easyappointments prior to 1.4.3. | 6.4 |