SourceCodester Patients Waiting Area Queue Management System 1.0 contains a SQL injection vulnerability in the /php/api_patient_schedule.php file via manipulation of the appointmentID parameter. This vulnerability can be exploited remotely without authentication. Public exploit code is available, and the vulnerability has a high severity rating with a CVSS score of 7.3.