CVE-2026-48078 OpenReception's schedule endpoint discloses isPublic=false channels and slot availability to unauthenticated callers

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.5, the unauthenticated /api/tenants/id/schedule endpoint returns every non-archived channel for a tenant regardless of the channel's isPublic flag. Channels marked...

EUVD-2026-54148

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.5, the unauthenticated /api/tenants/id/schedule endpoint returns every non-archived channel for a tenant regardless of the channel's isPublic flag. Channels marked...

CVE-2026-48076 OpenReception's bootstrap booking flow allows unauthenticated booking on isPublic=false channels

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. The new-client booking flow in versions 1.0.1 and prior consists of three calls: bootstrap-challenge returns a 16-bit PoW challenge with difficulty=4 leading hex zeroes, bootstrap-verify...

CVE-2026-65513

Unauthenticated Cross Site Scripting XSS in Simply Schedule Appointments = 1.6.12.10 versions...

CVE-2026-65508

Unauthenticated SQL Injection in Simply Schedule Appointments = 1.6.12.10 versions...

CVE-2026-65513

Unauthenticated Cross Site Scripting XSS in Simply Schedule Appointments = 1.6.12.10 versions...

CVE-2026-65513 WordPress Simply Schedule Appointments plugin <= 1.6.12.10 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Simply Schedule Appointments = 1.6.12.10 versions...

CVE-2026-65513

CVE-2026-65513 affects the WordPress plugin Simply Schedule Appointments (versions ≤ 1.6.12.10). The connected sources consistently describe an Unauthenticated XSS vulnerability impacting this plugin. The vulnerability is described without details on the exact vulnerable component, payload, or ex...

EUVD-2026-53964

Unauthenticated SQL Injection in Simply Schedule Appointments = 1.6.12.10 versions...

CVE-2026-65508 WordPress Simply Schedule Appointments plugin <= 1.6.12.10 - SQL Injection vulnerability

Unauthenticated SQL Injection in Simply Schedule Appointments = 1.6.12.10 versions...

CVE-2026-65508

Unauthenticated SQL Injection in Simply Schedule Appointments = 1.6.12.10 versions...

CVE-2026-65508

The CVE-2026-65508 entry concerns the WordPress plugin Simply Schedule Appointments (vulnerable:

WordPress Simply Schedule Appointments plugin < 1.6.12.6 - Unauthenticated Appointment Data Disclosure and Mass Deletion vulnerability

Unauthenticated Appointment Data Disclosure and Mass Deletion vulnerability discovered by Suleyman Huseynov in WordPress Plugin Simply Schedule Appointments versions 1.6.12.6...

CVE-2026-48078: Exposure of Sensitive Information to an Unauthorized Actor

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.5, the unauthenticated /api/tenants/id/schedule endpoint returns every non-archived channel for a tenant regardless of the channel's isPublic flag. Channels marked...

CVE-2026-65508: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in Simply Schedule Appointments = 1.6.12.10 versions...

CVE-2026-65513: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Simply Schedule Appointments = 1.6.12.10 versions...

CVE-2026-15254

The Simply Schedule Appointments WordPress plugin before 1.6.12.11 does not perform a capability check on an administrative appointment-listing shortcode, and its per-user result scoping fails open for non-staff users, allowing users with the Contributor role and above to disclose all customers'...

CVE-2026-15254 Simply Schedule Appointments < 1.6.12.11 - Contributor+ Sensitive Data Disclosure via Admin Shortcode

The Simply Schedule Appointments WordPress plugin before 1.6.12.11 does not perform a capability check on an administrative appointment-listing shortcode, and its per-user result scoping fails open for non-staff users, allowing users with the Contributor role and above to disclose all customers'...

EUVD-2026-52161

The Simply Schedule Appointments WordPress plugin before 1.6.12.11 does not perform a capability check on an administrative appointment-listing shortcode, and its per-user result scoping fails open for non-staff users, allowing users with the Contributor role and above to disclose all customers'...

CVE-2026-15254

The Simply Schedule Appointments WordPress plugin before 1.6.12.11 does not perform a capability check on an administrative appointment-listing shortcode, and its per-user result scoping fails open for non-staff users, allowing users with the Contributor role and above to disclose all customers'...