CVE-2026-5180 is a SQL injection vulnerability in SourceCodester Simple Doctors Appointment System 1.0. The vulnerability exists in the /admin/ajax.php?action=login2 script where the 'email' parameter is not properly sanitized, enabling remote attackers to inject SQL code. This can potentially lead to unauthorized database access or manipulation. The vulnerability is remotely exploitable without authentication and requires no user interaction. The CVSS 4.0 vector indicates low complexity and no privileges required, with partial impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data disclosure, modification, or deletion. The impact is rated medium severity with partial loss of confidentiality, integrity, and availability. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to implement input validation and parameterized queries on the affected endpoint to mitigate SQL injection risks. Monitor vendor channels for updates or patches addressing this vulnerability.