CVE-2026-19384
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
A weakness has been identified in SourceCodester Simple Doctors Appointment System 1.0. The affected element is an unknown function of the file /admin/ajax.php?action=set_appointment. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.
Risk Assessment
A remote attacker can exploit SQL injection to gain unauthorized access to the database, potentially leading to data leakage or modification.
Recommendation
Update the system to a patched version or apply proper input filtering. Restrict access to /admin/ajax.php.
Other vulnerabilities in SourceCodester Simple Doctors Appointment System
See all- CVE-2026-19839Medium
A vulnerability was detected in SourceCodester Simple Doctors Appointment System 1.0. The issue affects the save_doctor function in /save_file.php, allowing unrestricted file upload. The attack can be executed remotely, and the exploit is publicly available.
- CVE-2026-19231High
SourceCodester Simple Doctors Appointment System 1.0 has a SQL injection vulnerability in the file /admin/ajax.php?action=delete_appointment. Manipulation of the argument ID results in SQL injection, which can be launched remotely.
Original NVD description (English source)
A weakness has been identified in SourceCodester Simple Doctors Appointment System 1.0. The affected element is an unknown function of the file /admin/ajax.php?action=set_appointment. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.