Vendor
OpenReception appointment booking software prior to version 2.0.0 is vulnerable to host header injection in the confirmation email generation process, allowing unauthenticated attackers to hijack user accounts.