Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

appointment-booking-software — Vulnerabilities & Security Advisories 22

All 22 CVE vulnerabilities found in appointment-booking-software, with AI-generated Chinese analysis, references, and POCs.

This page documents security weaknesses affecting the appointment-booking-software product, specifically focusing on vulnerabilities identified within the vendor’s ecosystem. It aggregates data related to common weakness types such as authentication flaws, injection attacks, and security misconfigurations that impact the integrity and confidentiality of scheduling systems. The content covers publicly disclosed vulnerabilities ranging from early historical instances to recent disclosures, ensuring a comprehensive view of the product's security posture over time. Visitors can use this resource to track a vendor’s advisories, allowing them to stay informed about patches and recommended mitigations for critical issues. Users are able to understand a weakness class by analyzing recurring patterns across different versions and updates of the software. Additionally, the page enables researchers to look up a product's vulnerability history, providing context on how security risks have evolved as the application has matured. This structured approach facilitates better risk assessment for organizations relying on appointment scheduling tools. By consolidating these findings in one location, the page supports informed decision-making regarding software procurement and maintenance. It serves as a reference for security teams to evaluate potential exposure and prioritize remediation efforts based on verified data rather than speculation.

Vendor: open-reception

CVE ID Title CVSS Severity Published
CVE-2026-75525 OpenReception: unauthenticated ML-KEM key injection into the staff-crypto recipient directory in any tenant CWE-863 5.3 Medium 2026-10-23
CVE-2026-75524 OpenReception: race condition in add-to-tunnel and create-new-client allows overlapping appointments for one agent CWE-367 5.4 Medium 2026-10-23
CVE-2026-65825 OpenReception: one tenant's throttle row disables the PIN brute-force throttle for the same identifier in other tenants CWE-307 7.5 High 2026-10-23
CVE-2026-65824 OpenReception: invite confirmation token is replayable within its validity window and re-issues a registration-bootstrap cookie CWE-294 7.4 High 2026-10-23
CVE-2026-58202 OpenReception: Confirmation-email links built from the request Host enable pending-account takeover via `POST /api/auth/resend-confirmation` CWE-640 8.3 High 2026-10-23
CVE-2026-54460 OpenReception: Unauthenticated WebAuthn passkey injection via `POST /api/auth/passkeys` leads to account takeover CWE-306 9.8 Critical 2026-09-17
CVE-2026-48088 OpenReception vulnerable to unauthenticated staff crypto poisoning that breaks E2E recipient directory CWE-862 9.4 Critical 2026-08-06
CVE-2026-48087 OpenReception: WebAuthn passkey injection allows account takeover CWE-287 9.8 Critical 2026-08-06
CVE-2026-48086 OpenReception: Tenant admin self-promotes to GLOBAL_ADMIN CWE-269 9.9 Critical 2026-08-06
CVE-2026-48085 OpenReception has unauthenticated GLOBAL_ADMIN account creation post-bootstrap CWE-862 9.8 Critical 2026-08-06
CVE-2026-48084 OpenReception doesn't rate limit passphrase login attempts CWE-307 7.4 High 2026-08-06
CVE-2026-48083 OpenReception: Unauthenticated POST /api/log accepts arbitrary content with CRLF injection and no size or rate limits CWE-117 6.5 Medium 2026-08-06
CVE-2026-48082 OpenReception's bootstrap challenge proof-of-work difficulty hardcoded to 16 bits, which enables abuse rate amplification CWE-770 3.7 Low 2026-08-06
CVE-2026-48081 OpenReception vulnerable to stored click-triggered XSS via javascript: tenant links rendered into patient-facing footer CWE-79 8.1 High 2026-08-06
CVE-2026-48079 OpenReception's logout page clears local access_token before server-side revocation, leaving duplicated tokens valid until expiry CWE-613 7.4 High 2026-08-06
CVE-2026-48078 OpenReception's schedule endpoint discloses isPublic=false channels and slot availability to unauthenticated callers CWE-200 5.3 Medium 2026-08-06
CVE-2026-48077 OpenReception: GET appointment by ID returns full appointment record without authorization CWE-862 5.3 Medium 2026-08-06
CVE-2026-48076 OpenReception's bootstrap booking flow allows unauthenticated booking on isPublic=false channels CWE-863 6.5 Medium 2026-08-06
CVE-2026-48075 OpenReception's unauthenticated add-to-tunnel endpoint accepts arbitrary appointment injections CWE-862 6.5 Medium 2026-08-06
CVE-2026-48074 OpenReception: Staff deletion removes pending invites cross-tenant by email match CWE-863 2.7 Low 2026-08-06
CVE-2026-48071 OpenReception's client PIN challenge throttle is keyed by emailHash only, allowing cross-tenant lockout CWE-307 5.8 Medium 2026-08-06
CVE-2026-48080 OpenReception's tenant detail endpoint discloses live PostgreSQL connection string, superuser-scoped in the tested official deployment CWE-200 8.0 High 2026-08-06

All 22 known CVE vulnerabilities affecting appointment-booking-software with full Chinese analysis, references, and POCs where available.