CVE-2026-19839
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
A vulnerability was detected in SourceCodester Simple Doctors Appointment System 1.0. The issue affects the save_doctor function in /save_file.php, allowing unrestricted file upload. The attack can be executed remotely, and the exploit is publicly available.
Risk Assessment
The risk includes the possibility of remote upload of malicious files, potentially leading to system compromise or arbitrary code execution.
Recommendation
It is recommended to immediately update the system or apply vendor patches, and restrict access to /save_file.php.
Other vulnerabilities in SourceCodester Simple Doctors Appointment System
See all- CVE-2026-19384High
A weakness has been identified in SourceCodester Simple Doctors Appointment System 1.0. The affected element is an unknown function of the file /admin/ajax.php?action=set_appointment. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.
- CVE-2026-19231High
SourceCodester Simple Doctors Appointment System 1.0 has a SQL injection vulnerability in the file /admin/ajax.php?action=delete_appointment. Manipulation of the argument ID results in SQL injection, which can be launched remotely.
Original NVD description (English source)
A vulnerability was detected in SourceCodester Simple Doctors Appointment System 1.0. This issue affects the function save_doctor of the file /save_file.php. The manipulation results in unrestricted upload. The attack can be executed remotely. The exploit is now public and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS