CVE-2026-105470
HighCVSS 7.3Summary
In girishsaraf Online-Appointment-Booking-System up to commit f427b4757128ca253d33d0cc4e87bbb9c999a4d5, the function mysqli_query in locateus.php (Doctor Search Endpoint) is vulnerable to SQL injection via the doctorname argument. The attack can be performed remotely, and the exploit is publicly available.
Risk Assessment
An attacker can exploit SQL injection to read, modify, or delete data in the database, potentially leading to data confidentiality and integrity breaches.
Recommendation
Apply vendor patches if available. Otherwise, use parameterized queries or prepared statements to prevent SQL injection.
Other vulnerabilities in Online-Appointment-Booking-System
See all- CVE-2026-105472Medium
A SQL injection vulnerability was identified in girishsaraf Online-Appointment-Booking-System in the book.php file of the Booking Handler component. Manipulation of the Doctor/appointment argument allows remote attacks, and the exploit has been made publicly available.
- CVE-2026-105471High
A SQL injection vulnerability was discovered in girishsaraf Online-Appointment-Booking-System in signup.php within the Registration Handler component. Manipulation of the fname argument allows SQL injection. The attack can be executed remotely and the exploit has been publicly released.
- CVE-2026-105469High
In girishsaraf Online-Appointment-Booking-System up to commit f427b4757128ca253d33d0cc4e87bbb9c999a4d5, in get_town.php (AJAX Endpoint), manipulation of arguments countryid/townid/cid/didval/cidval leads to SQL injection. The attack can be launched remotely, and the exploit has been publicly disclosed.
- CVE-2026-105468High
In girishsaraf Online-Appointment-Booking-System up to commit f427b4757128ca253d33d0cc4e87bbb9c999a4d5, the function mysqli_query in Admin/mlogin.php (Login Handler) is vulnerable to SQL injection via the uname/pass arguments. The attack can be initiated remotely, and the exploit has been made public.
- CVE-2026-105387High
A security flaw has been discovered in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects the function mysqli_query of the file cover.php of the component Patient Login Handler. The manipulation of the argument uname/psw results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.
Original NVD description (English source)
A vulnerability was identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This issue affects the function mysqli_query of the file locateus.php of the component Doctor Search Endpoint. The manipulation of the argument doctorname leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS