CVE-2026-85225: SQL Injection in code-projects Doctor Appointment System

This vulnerability in code-projects Doctor Appointment System 1.0 allows remote attackers to perform SQL injection via the email argument in the /patient_login.php file. The flaw enables unauthorized database queries that could lead to data exposure or manipulation. The CVSS 4.0 base score is 6.9, reflecting medium severity with network attack vector, low complexity, no privileges or user interaction required, and limited confidentiality, integrity, and availability impacts. No official fix or patch has been published yet, and the exploit is publicly available.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is limited to the confidentiality, integrity, and availability of the affected system as indicated by the CVSS vector. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying web application firewalls or input validation controls to mitigate SQL injection risks in the affected parameter.