CVE-2026-48075

OpenReception’s OpenReception appointment-booking software contains an unauthenticated add-to-tunnel endpoint prior to version 1.0.5. The endpoint accepts any valid tunnelId and any emailHash (even across tunnels) to insert an appointment with status = CONFIRMED, attacker-controlled ciphertext fi...

PT-2026-68737

Name of the Vulnerable Software and Affected Versions OpenReception versions prior to 1.0.5 Description The add-to-tunnel endpoint allows the creation of new appointment rows in any client tunnel without caller authentication. By providing a valid tunnelId and emailHash, an attacker can insert...

EUVD-2023-43960

Malicious code in bioql PyPI...

CVE-2023-3285

A BOLA vulnerability in POST /appointments allows a low privileged user to create an appointment for any user in the system including admin. This results in unauthorized data manipulation...