Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
2.1

Online Appointment Booking System allows remote data manipulation

CVE-2026-105472 · published 13 days ago
Summary

The booking page (book.php) in the Online Appointment Booking System can be tricked by sending specially crafted information in the Doctor/appointment field, causing the system to run unintended commands on its database. This can be done from anywhere on the internet and could let an attacker view or change appointment data. Apply the latest updates from the vendor or add proper checks on input to block this behavior.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
girishsaraf online-appointment-booking-system f427b4757128ca253d33d0cc4e87bbb9c999a4d5
Original advisory text
girishsaraf Online-Appointment-Booking-System Booking book.php sql injection
A weakness has been identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. The affected element is an unknown function of the file book.php of the component Booking Handler. This manipulation of the argument Doctor/appointment causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
2.1 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-74Injection
CWE-89SQL Injection
Timeline
Published6 Oct 2026
Updated14 Oct 2026
First seen6 Oct 2026
Sources
CVE-2026-105472 · NVD
CVE-2026-105472 · MITRE
CVE-2026-105472 · OSV
Track software like this
Free during beta