Threat database

CVE-2026-116112 is a medium severity SQL injection vulnerability in the HashenUdara edoc-doctor-appointment-system. The flaw exists in an unknown function within the file admin/add-new.php, where manipulation of the 'spec' argument allows remote attackers to perform SQL injection. The product uses a rolling release model, so no specific affected or fixed versions are available. The vendor has not responded to disclosure attempts, and no patch or remediation guidance is currently available. Public exploit code exists but no confirmed exploitation in the wild has been reported.