Vendor
Alex Tselegidis
23 known vulnerabilities.
13 results · Clear filters · Feed
-
Medium 5.3
Plainpad Missing Rate Limiting via POST /v1/sessions
Plainpad through 1.1.1, fixed in commit d3823fc, contains a missing rate limiting vulnerability that allows unauthenticated attackers to send unbounded login requests to the POST /v1/sessions endpoint due to dead code in App\Http\Kernel.php that is never inst…
-
Medium 6.9
Easy!Appointments has unauthenticated customer PII disclosure on booking reschedule page
Easy!Appointments is a self hosted appointment scheduler. In versions up to and including 1.5.2, the booking reschedule view at `/index.php/booking/reschedule/{appointment_hash}` (handled by `Booking::index()`) embeds the entire customer record as inline Java…
-
Medium 4.3
WordPress Easy!Appointments plugin <= 1.4.2 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in alextselegidis Easy!Appointments easyappointments allows Cross Site Request Forgery.This issue affects Easy!Appointments: from n/a through <= 1.4.2.
-
Medium 6.3
WordPress Easy!Appointments plugin <= 1.3.3 - Arbitrary File Deletion vulnerability
Missing Authorization vulnerability in Alex Tselegidis Easy!Appointments.This issue affects Easy!Appointments: from n/a through 1.3.3.
-
Medium 6.4
Easy!Appointments <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Easy!Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'easyappointments' shortcode in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping on user supplied attri…
-
Medium 6.3
Authorization Bypass Through User-Controlled Key in alextselegidis/easyappointments
Authorization Bypass Through User-Controlled Key in GitHub repository alextselegidis/easyappointments prior to 1.5.0.
-
Medium 6.3
Open Redirect in alextselegidis/easyappointments
Open Redirect in GitHub repository alextselegidis/easyappointments prior to 1.5.0.
-
Medium 5.4
Improper Access Control in alextselegidis/easyappointments
Improper Access Control in GitHub repository alextselegidis/easyappointments prior to 1.5.0.
-
Medium 6.8
Cross-site Scripting (XSS) - Stored in alextselegidis/easyappointments
Cross-site Scripting (XSS) - Stored in GitHub repository alextselegidis/easyappointments prior to 1.5.0.
-
Medium 4.3
Cross-site Scripting (XSS) - Stored in alextselegidis/easyappointments
Cross-site Scripting (XSS) - Stored in GitHub repository alextselegidis/easyappointments prior to 1.5.0.
-
Medium 5.4
Session Fixation in alextselegidis/easyappointments
Session Fixation in GitHub repository alextselegidis/easyappointments prior to 1.5.0.
-
Medium 6.0
Code Injection in alextselegidis/easyappointments
Code Injection in GitHub repository alextselegidis/easyappointments prior to 1.5.0.
-
Medium 6.5
Use of Hard-coded Credentials in alextselegidis/easyappointments
Use of Hard-coded Credentials in GitHub repository alextselegidis/easyappointments prior to 1.5.0.