Threat database

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Stored XSS.This issue affects Simply Schedule Appointments: from n/a through 1.6.12.35.

CVE-2026-110381 is an authorization bypass vulnerability in NSquared Simply Schedule Appointments that arises from user-controlled keys allowing incorrect access control. It affects versions from initial releases up to but not including 1.6.12.37. The vulnerability has a medium severity with a CVSS score of 6.3, indicating a network attack vector with low attack complexity but requiring privileges. It impacts confidentiality, integrity, and availability at a low to medium level. No known exploits are reported in the wild, and no official patch information is provided.

Unauthenticated Insecure Direct Object References (IDOR) in Simply Schedule Appointments <= 1.6.12.31 versions.

Unauthenticated Broken Access Control in Simply Schedule Appointments <= 1.6.12.29 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in Simply Schedule Appointments <= 1.6.12.23 versions.

CVE-2026-65513 is a high-severity unauthenticated cross-site scripting (XSS) vulnerability in NSquared Simply Schedule Appointments affecting versions up to and including 1.6.12.10. This vulnerability allows an attacker to inject malicious scripts during web page generation, potentially impacting confidentiality, integrity, and availability. No official patch or remediation guidance is currently available from the vendor.

Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.12.10 versions.

Missing Authorization vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simply Schedule Appointments: from n/a through 1.6.11.11.

Missing Authorization vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simply Schedule Appointments: from n/a through <= 1.6.12.4.

Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.12.2 versions.

CVE-2026-42384 is a high-severity vulnerability in NSquared's Simply Schedule Appointments software versions prior to 1.6.11.2. It involves unauthenticated exposure of sensitive data due to insertion of sensitive information into sent data. The vulnerability does not require user interaction or privileges to exploit and impacts confidentiality without affecting integrity or availability.

Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.9.27 versions.

CVE-2026-39447 is a high-severity unauthenticated Cross-Site Scripting (XSS) vulnerability affecting Simply Schedule Appointments versions up to and including 1.6.10.6. This vulnerability allows an attacker to inject malicious scripts during web page generation without requiring authentication. The vulnerability is identified as CWE-79, indicating improper neutralization of input. No official patch or remediation guidance is currently provided by the vendor.

Missing Authorization vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simply Schedule Appointments: from n/a through <= 1.6.10.2.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Blind SQL Injection.This issue affects Simply Schedule Appointments: from n/a through <= 1.6.9.27.

Missing Authorization vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simply Schedule Appointments: from n/a through <= 1.6.9.15.