CVE-2026-85402

HighCVSS 7.3

Published: 04/09/2026(UTC)Updated: 11/09/2026(UTC)Translated: 04/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

19th percentile - higher than 19% of all known CVEs

Summary

A vulnerability was detected in code-projects Doctor Appointment System 1.0. This vulnerability affects unknown code of the file /patient/booking.php. The manipulation of the argument doc_id results in sql injection. The attack may be launched remotely. The exploit is now public and may be used.

Risk Assessment

An attacker could exploit the SQL injection to gain unauthorized access to patient and booking data, compromising confidentiality and integrity.

Recommendation

Apply patches immediately, validate input, and use parameterized queries in /patient/booking.php.

Other vulnerabilities in Doctor Appointment System

CVE-2026-85403High
A flaw has been found in code-projects Doctor Appointment System 1.0. This issue affects some unknown processing of the file /contactus.php. This manipulation of the argument firstname causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and may be used.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS