CVE-2025-50455
SQL injection exists in the order_by parameter of the /customers/search endpoint in Alex Tselegidis EasyAppointments 1.5.1 or earlier. Unsanitized input allows attackers to run time‑based queries, enumerate the database schema, and under certain MySQL settings could write a PHP shell for remote code execution.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Alex Tselegidis EasyAppointments version 1.5.1 and earlier, typically used by small businesses for appointment scheduling.
Real-world impact
An attacker could read or modify sensitive data, discover database structure, and potentially gain full control of the web server by uploading a PHP shell.
Why this severity
The CVSS score of 9.1 reflects that the flaw can be exploited over the network with no user interaction, no privileges, and has high confidentiality and integrity impact, while availability is not affected.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jul 27, 2026 · 5d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 30, 2026 · 1d agoAdvisory updatedThe NVD record was last revised.