CVE-2026-19384 is a SQL injection vulnerability in SourceCodester Simple Doctors Appointment System 1.0. The flaw exists in an unspecified function within /admin/ajax.php when processing the 'ID' parameter in the 'set_appointment' action. This improper input validation allows remote attackers to inject SQL commands, potentially compromising the database. The vulnerability is remotely exploitable without authentication and has a medium severity rating based on CVSS 4.0 metrics. No official fix or patch has been published at this time.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access, data modification, or other database-related impacts depending on the database privileges. However, the CVSS vector indicates low to limited impact on confidentiality, integrity, and availability, reflecting a medium severity risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the absence of an official fix, users should consider restricting access to the vulnerable endpoint, applying web application firewall rules to detect and block SQL injection attempts, and monitoring for suspicious activity targeting the affected parameter.