https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 22:04:09 +0000 https://cve.radiocsirt.org/vuln/cve-2026-52837 <p><strong>Affected:</strong> alextselegidis easyappointments</p> <p>Easy!Appointments is a self hosted appointment scheduler. In versions up to and including 1.5.2, the booking reschedule view at `/index.php/booking/reschedule/{appointment_hash}` (handled by `Booking::index()`) embeds the entire customer record as inline JavaScript (`const vars = {... &#34;customer_data&#34;: {...}, ...}`) without authentication and without field whitelisting. Anyone in possession of the 12-character `appointment_hash` — which appears in plain text in reschedule emails, confirmation page URLs, and operator-side calendar links — can read every column of that customer&#39;s row in the `ea_users` table. Version 1.6.0 contains a patch.</p> <p><strong>Affected:</strong> alextselegidis easyappointments</p> <p>Easy!Appointments is a self hosted appointment scheduler. In versions up to and including 1.5.2, the booking reschedule view at `/index.php/booking/reschedule/{appointment_hash}` (handled by `Booking::index()`) embeds the entire customer record as inline JavaScript (`const vars = {... &#34;customer_data&#34;: {...}, ...}`) without authentication and without field whitelisting. Anyone in possession of the 12-character `appointment_hash` — which appears in plain text in reschedule emails, confirmation page URLs, and operator-side calendar links — can read every column of that customer&#39;s row in the `ea_users` table. Version 1.6.0 contains a patch.</p> https://cve.radiocsirt.org/vuln/cve-2026-52837