CVE-2026-85225: SQL Injection in code-projects Doctor Appointment System

The code-projects Doctor Appointment System version 1.0 contains a SQL injection vulnerability in the /patient_login.php file. The vulnerability arises from improper sanitization of the email input parameter, allowing an attacker to inject malicious SQL commands. This can be exploited remotely without any privileges or user interaction. The vulnerability is identified as CWE-89 (SQL Injection) and CWE-74 (Injection). No patch or remediation details are currently available, and no known active exploitation in the wild has been reported.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access, data modification, or other database-related impacts depending on the database privileges of the application. The vulnerability is remotely exploitable without authentication, increasing its risk. However, the CVSS score of 6.9 indicates a moderate impact level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation and parameterized queries to mitigate SQL injection risks in the affected component. Monitor vendor channels for updates or patches addressing this vulnerability.