CVE-2026-37600 identifies a SQL Injection vulnerability in SourceCodester Patient Appointment Scheduler System v1.0, specifically in the /scheduler/admin/appointments/view_details.php file. The vulnerability allows injection of malicious SQL code through unsanitized input, which could compromise the integrity and confidentiality of the application's database. No official patch or remediation level has been published, and no known exploits have been reported.

Successful exploitation of this SQL Injection vulnerability could allow an attacker to read, modify, or delete sensitive data stored in the application's database. This may lead to unauthorized disclosure of patient appointment information or other confidential data managed by the system. However, no active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation and parameterized queries as temporary mitigations to reduce the risk of SQL Injection. Monitor vendor channels for updates regarding patches or official remediation.