CVE-2026-19231 is a SQL injection vulnerability found in SourceCodester Simple Doctors Appointment System 1.0. The issue exists in the handling of the 'ID' parameter in the /admin/ajax.php?action=delete_appointment file, where improper input sanitization allows attackers to inject SQL commands. This vulnerability can be exploited remotely without authentication. Public exploit code has been released, increasing the risk of exploitation. No official fix or vendor advisory is currently available, and the patch status is unknown.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries on the backend database. This may lead to unauthorized data access, modification, or deletion. The vulnerability is remotely exploitable without privileges or user interaction, increasing its risk. However, the CVSS vector indicates low to limited impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable endpoint and consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the 'ID' parameter.