CVE-2025-29448 Easy!Appointments Denial of Service (DoS)
Unauthenticated attackers can block all future bookings by creating appointments with excessively long durations in Easy!Appointments.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-29448?
CVE-2025-29448 is a high-severity vulnerability in n/a, published on 7 May 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Booking logic flaw in Easy!Appointments v1.5.1 allows unauthenticated attackers to create appointments with excessively long durations, causing a denial of service by blocking all future booking availability.
Weakness: CWE-284
Which versions are affected by CVE-2025-29448?
2 open source packages ship an affected version, including alextselegidis/easyappointments. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
alextselegidis/easyappointments Packagist | All versions to 1.5.1 | None |
alextselegidis/easyappointments Packagist | All versions to 1.5.1 | None |
Products include Easyappointments Easy\!appointments.
How do I fix CVE-2025-29448?
No fix has been published for CVE-2025-29448 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-29448 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-29448 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in n/a
- CVE-2025-50383 Easy!Appointments SQL injection vulnerability
- CVE-2018-13063 Missing authorization in n/a
- CVE-2026-23622 CSRF Protection Bypass: Sensitive endpoints accept GET requests, enabling admin account takeover
- CVE-2018-13060 Security feature bypass in n/a
- CVE-2024-0698 Easy!Appointments <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Sources
Also known as GHSA-hcjv-982c-5f29.