https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 08:32:43 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-342440 EUVD-2026-342440 https://cve.radiocsirt.org/vuln/euvd-2026-342440 https://cve.radiocsirt.org/vuln/fkie_cve-2026-52837 <p>Easy!Appointments is a self hosted appointment scheduler. In versions up to and including 1.5.2, the booking reschedule view at `/index.php/booking/reschedule/{appointment_hash}` (handled by `Booking::index()`) embeds the entire customer record as inline JavaScript (`const vars = {... &#34;customer_data&#34;: {...}, ...}`) without authentication and without field whitelisting. Anyone in possession of the 12-character `appointment_hash` — which appears in plain text in reschedule emails, confirmation page URLs, and operator-side calendar links — can read every column of that customer&#39;s row in the `ea_users` table. Version 1.6.0 contains a patch.</p> <p>Easy!Appointments is a self hosted appointment scheduler. In versions up to and including 1.5.2, the booking reschedule view at `/index.php/booking/reschedule/{appointment_hash}` (handled by `Booking::index()`) embeds the entire customer record as inline JavaScript (`const vars = {... &#34;customer_data&#34;: {...}, ...}`) without authentication and without field whitelisting. Anyone in possession of the 12-character `appointment_hash` — which appears in plain text in reschedule emails, confirmation page URLs, and operator-side calendar links — can read every column of that customer&#39;s row in the `ea_users` table. Version 1.6.0 contains a patch.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-52837 https://cve.radiocsirt.org/vuln/ghsa-xgr6-pqjv-3pf8 <p><strong>Affected:</strong> Packagist: alextselegidis/easyappointments</p> <p>## Summary</p> <p>The booking reschedule view at `/index.php/booking/reschedule/{appointment_hash}` (handled by `Booking::index()`) embeds the **entire customer record** as inline JavaScript (`const vars = {... &#34;customer_data&#34;: {...}, ...}`) without authentication and without field whitelisting. Anyone in possession of the 12-character `appointment_hash` — which appears in plain text in reschedule emails, confirmation page URLs, and operator-side calendar links — can read every column of that customer&#39;s row in the `ea_users` table.</p> <p>Verified against v1.5.2 with a Docker reproduction; a single anonymous GET to the reschedule URL returns 13 customer fields including email, phone, full address, custom fields, timezone, language, LDAP DN, and `id_roles`.</p> <p>## Details</p> <p>### Root cause</p> <p>`application/controllers/Booking.php` at line 184 reads the hash from the request, fetches the appointment, then loads the customer with `Customers_model::find()` — which returns the full row, no projection. It then passes the full record into `script_vars()`, which inlines it into the response HTML as a JavaScript constant. The reschedule UI itself uses only `first_name` and `last_name`; everything else is exposed for no functional reason.</p> <p>```php // application/controllers/Booking.php (v1.5.2) $appointment_hash = html_vars(&#39;appointment_hash&#39;); // line 184 if (!empty($appointment_hash)) { $manage_mode = true; $results = $this-&gt;appointments_model-&gt;get([&#39;hash&#39; =&gt; $appointment_hash]); //…</p> <p><strong>Affected:</strong> Packagist: alextselegidis/easyappointments</p> <p>## Summary</p> <p>The booking reschedule view at `/index.php/booking/reschedule/{appointment_hash}` (handled by `Booking::index()`) embeds the **entire customer record** as inline JavaScript (`const vars = {... &#34;customer_data&#34;: {...}, ...}`) without authentication and without field whitelisting. Anyone in possession of the 12-character `appointment_hash` — which appears in plain text in reschedule emails, confirmation page URLs, and operator-side calendar links — can read every column of that customer&#39;s row in the `ea_users` table.</p> <p>Verified against v1.5.2 with a Docker reproduction; a single anonymous GET to the reschedule URL returns 13 customer fields including email, phone, full address, custom fields, timezone, language, LDAP DN, and `id_roles`.</p> <p>## Details</p> <p>### Root cause</p> <p>`application/controllers/Booking.php` at line 184 reads the hash from the request, fetches the appointment, then loads the customer with `Customers_model::find()` — which returns the full row, no projection. It then passes the full record into `script_vars()`, which inlines it into the response HTML as a JavaScript constant. The reschedule UI itself uses only `first_name` and `last_name`; everything else is exposed for no functional reason.</p> <p>```php // application/controllers/Booking.php (v1.5.2) $appointment_hash = html_vars(&#39;appointment_hash&#39;); // line 184 if (!empty($appointment_hash)) { $manage_mode = true; $results = $this-&gt;appointments_model-&gt;get([&#39;hash&#39; =&gt; $appointment_hash]); //…</p> https://cve.radiocsirt.org/vuln/ghsa-xgr6-pqjv-3pf8