CVE-2026-105471
HighCVSS 7.3Summary
A SQL injection vulnerability was discovered in girishsaraf Online-Appointment-Booking-System in signup.php within the Registration Handler component. Manipulation of the fname argument allows SQL injection. The attack can be executed remotely and the exploit has been publicly released.
Risk Assessment
The vulnerability allows remote execution of arbitrary SQL queries, potentially leading to data leakage, modification, or deletion. The public exploit increases the risk of rapid exploitation.
Recommendation
Immediately review and fix input validation in signup.php using parameterized queries. Until a patch is available, restrict access to the application or disable it.
Other vulnerabilities in Online-Appointment-Booking-System
See all- CVE-2026-105472Medium
A SQL injection vulnerability was identified in girishsaraf Online-Appointment-Booking-System in the book.php file of the Booking Handler component. Manipulation of the Doctor/appointment argument allows remote attacks, and the exploit has been made publicly available.
- CVE-2026-105470High
In girishsaraf Online-Appointment-Booking-System up to commit f427b4757128ca253d33d0cc4e87bbb9c999a4d5, the function mysqli_query in locateus.php (Doctor Search Endpoint) is vulnerable to SQL injection via the doctorname argument. The attack can be performed remotely, and the exploit is publicly available.
- CVE-2026-105469High
In girishsaraf Online-Appointment-Booking-System up to commit f427b4757128ca253d33d0cc4e87bbb9c999a4d5, in get_town.php (AJAX Endpoint), manipulation of arguments countryid/townid/cid/didval/cidval leads to SQL injection. The attack can be launched remotely, and the exploit has been publicly disclosed.
- CVE-2026-105468High
In girishsaraf Online-Appointment-Booking-System up to commit f427b4757128ca253d33d0cc4e87bbb9c999a4d5, the function mysqli_query in Admin/mlogin.php (Login Handler) is vulnerable to SQL injection via the uname/pass arguments. The attack can be initiated remotely, and the exploit has been made public.
- CVE-2026-105387High
A security flaw has been discovered in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects the function mysqli_query of the file cover.php of the component Patient Login Handler. The manipulation of the argument uname/psw results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.
Original NVD description (English source)
A security flaw has been discovered in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Impacted is an unknown function of the file signup.php of the component Registration Handler. The manipulation of the argument fname results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS