https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T17:45:32.012483+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-265888 EUVD-2026-265888 2026-10-06T17:45:32.057817+00:00 EUVD-2026-265888 https://cve.radiocsirt.org/vuln/fkie_cve-2026-23622 fkie_cve-2026-23622 2026-10-06T17:45:32.057857+00:00

Easy!Appointments is a self hosted appointment scheduler. In 1.5.2 and earlier, application/core/EA_Security.php::csrf_verify() only enforces CSRF for POST requests and returns early for non-POST methods. Several application endpoints perform state-changing operations while accepting parameters from GET (or $_REQUEST), so an attacker can perform CSRF by forcing a victim's browser to issue a crafted GET request. Impact: creation of admin accounts, modification of admin email/password, and full admin account takeover.

 https://cve.radiocsirt.org/vuln/ghsa-54v4-4685-vwrj GHSA-54v4-4685-vwrj — alextselegidis/easyappointments is Vulnerable to CSRF Protection Bypass 2026-10-06T17:45:32.057893+00:00

Affected: Packagist: alextselegidis/easyappointments

### Summary `application/core/EA_Security.php::csrf_verify()` only enforces CSRF for POST requests and returns early for non-POST methods. Several application endpoints perform state-changing operations while accepting parameters from GET (or $_REQUEST), so an attacker can perform CSRF by forcing a victim's browser to issue a crafted GET request. Impact: creation of admin accounts, modification of admin email/password, and full admin account takeover

### Details

in https://github.com/alextselegidis/easyappointments/blob/41c9b93a5a2c185a914f204412324d8980943fd5/application/core/EA_Security.php#L52

* **Repository / tested commit:** `alextselegidis/easyappointments` — commit `41c9b93a5a2c185a914f204412324d8980943fd5`. * **Vulnerable file & function:** `application/core/EA_Security.php::csrf_verify()` — around line 52. Link: `.../application/core/EA_Security.php#L52`. * **Root cause:** The function early-returns when the request is not `POST`:

```php // vulnerable snippet if (strtoupper($_SERVER['REQUEST_METHOD']) !== 'POST') { return $this->csrf_set_cookie(); } ```

Because of this, non-POST requests (GET/PUT/DELETE/etc.) never reach token validation. When application controllers accept state-changing parameters via `GET` or `$_REQUEST`, these requests bypass CSRF checks entirely and the application executes the state change.

* **Examples of vulnerable endpoints (observed during testing):**

* `index.php/admins/store` — create admin (accepts fields via GET) * `inde…