CVE-2026-19231
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
SourceCodester Simple Doctors Appointment System 1.0 has a SQL injection vulnerability in the file /admin/ajax.php?action=delete_appointment. Manipulation of the argument ID results in SQL injection, which can be launched remotely.
Risk Assessment
An attacker can gain unauthorized access to the database, modify or delete data, compromising system integrity and confidentiality.
Recommendation
Apply vendor patches or use parameterized queries to prevent SQL injection.
Other vulnerabilities in SourceCodester Simple Doctors Appointment System
See all- CVE-2026-19839Medium
A vulnerability was detected in SourceCodester Simple Doctors Appointment System 1.0. The issue affects the save_doctor function in /save_file.php, allowing unrestricted file upload. The attack can be executed remotely, and the exploit is publicly available.
- CVE-2026-19384High
A weakness has been identified in SourceCodester Simple Doctors Appointment System 1.0. The affected element is an unknown function of the file /admin/ajax.php?action=set_appointment. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.
Original NVD description (English source)
A security flaw has been discovered in SourceCodester Simple Doctors Appointment System 1.0. This vulnerability affects unknown code of the file /admin/ajax.php?action=delete_appointment. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.