Easy!Appointments

Mentions · 7d0
Mentions · 30d0
All mentions1
First seenAug 17, 2026
Last mentionedAug 17, 2026

Timeline

1 articles · newest first

AI Tool Identifies BOLA Vulnerabilities in Easy!Appointments

Unit 42's AI-powered tool found 15 BOLA vulnerabilities in Easy!Appointments, rated up to CVSS 9.9, letting low-privileged users escalate privileges; fixed in 1.5.0.

Palo Alto Unit 42Aug 17, 12:35 UTC · Aug 17, 2026VulnerabilityCVE-2023-3285 CVE-2023-3286 CVE-2023-3287+131

Related CVEs

by mentions

CVE-2023-3287<1%8.8
A BOLA vulnerability in POST /admins allows a low privileged user to create a high privileged user (admin) in the system
published Jul 9, 2024easyappointments easyappointments
CVE-2023-3288<1%8.8
A BOLA vulnerability in POST /providers allows a low privileged user to create a privileged user (provider) in the system
published Jul 9, 2024easyappointments easyappointments
CVE-2023-38054<1%8.1
A BOLA vulnerability in GET, PUT, DELETE /customers/{customerId} allows a low privileged user to fetch, modify or delete a low privileged user (customer)
published Jul 9, 2024easyappointments easyappointments
CVE-2023-38050<1%8.1
A BOLA vulnerability in GET, PUT, DELETE /webhooks/{webhookId} allows a low privileged user to fetch, modify or delete a webhook of any user (including admin)
published Jul 9, 2024easyappointments easyappointments
CVE-2023-38051<1%8.1
A BOLA vulnerability in GET, PUT, DELETE /secretaries/{secretaryId} allows a low privileged user to fetch, modify or delete a low privileged user (secretary)
published Jul 9, 2024easyappointments easyappointments
CVE-2023-38055<1%8.1
A BOLA vulnerability in GET, PUT, DELETE /services/{serviceId} allows a low privileged user to fetch, modify or delete the services of any user (including…
published Jul 9, 2024easyappointments easyappointments
CVE-2023-3285<1%7.7
A BOLA vulnerability in POST /appointments allows a low privileged user to create an appointment for any user in the system (including admin)
published Jul 9, 2024
CVE-2023-3289<1%6.5
A BOLA vulnerability in POST /services allows a low privileged user to create a service for any user in the system (including admin)
published Jul 9, 2024easyappointments easyappointments
CVE-2024-1313<1%6.5
It is possible for a user in a different organization from the owner of a snapshot to bypass authorization and delete a snapshot by issuing a DELETE request to…
published Mar 26, 2024
CVE-2023-3290<1%5.0
A BOLA vulnerability in POST /customers allows a low privileged user to create a low privileged user (customer) in the system
published Jul 9, 2024easyappointments easyappointments

Appears with

Palo Alto Networksorganization · 1
Unit 42organization · 1
Unit 42threat actor · 1
Easy!Appointmentsproduct · 1
Palo Alto Networksvendor · 1
Grafanaproduct · 1

Entities are extracted by the model from each article. First seen Aug 17, 2026, last mentioned Aug 17, 2026. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.