A vulnerability was identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects an unknown part of the file changebookingstatus.php of the component submit2 Handler. Such manipulation of the argument username[]/timestamp[]/status[] leads to missing authorization. The attack may be performed from remote. The exploit is publicly available and might be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-109524 is a medium severity vulnerability in the girishsaraf Online-Appointment-Booking-System up to commit f427b4757128ca253d33d0cc4e87bbb9c999a4d5. It involves missing authorization in the Admin/showdoctor.php file within the Admin Display Pages component. The vulnerability can be exploited remotely without authentication or user interaction. The project uses a rolling release model, so specific affected or fixed versions are not provided. The issue was reported early but has not yet been addressed by the vendor. Public exploit details are available, but no known exploitation in the wild has been confirmed.
CVE-2026-109523 is a medium severity SQL injection vulnerability in the girishsaraf Online-Appointment-Booking-System. It affects an unknown functionality in the Admin/getclinic.php file's AJAX endpoint, where the city/cid argument can be manipulated to perform SQL injection. The vulnerability can be exploited remotely without authentication. The product uses a rolling release model, so specific affected or fixed versions are not available. The vendor has been informed but has not yet responded or issued a patch. Exploit code has been publicly disclosed.
CVE-2026-109522 is a medium severity SQL injection vulnerability in the girishsaraf Online-Appointment-Booking-System. It affects an unknown function in the Admin/deleteclinic.php file within the Admin CRUD Endpoint. The vulnerability arises from improper handling of the cid/did arguments, allowing remote attackers to perform SQL injection. The product uses a rolling release model, so specific affected or fixed versions are not provided. The issue was reported early to the project but has not yet been addressed. Public exploit details have been disclosed, but no known exploits are currently observed in the wild.
A vulnerability was detected in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects an unknown function of the file changebookingstatus.php. Performing a manipulation of the argument dateselected results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-105472 is a medium severity SQL injection vulnerability in the girishsaraf Online-Appointment-Booking-System affecting the book.php file's Booking Handler component. The vulnerability arises from improper handling of the Doctor/appointment argument, allowing remote attackers to execute SQL injection attacks. The product uses a rolling release strategy, so specific affected versions are not identified. The issue was reported early to the project, but no response or patch has been provided yet. Public exploit code is available, increasing the risk of exploitation.
A security flaw has been discovered in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Impacted is an unknown function of the file signup.php of the component Registration Handler. The manipulation of the argument fname results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
A vulnerability was identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This issue affects the function mysqli_query of the file locateus.php of the component Doctor Search Endpoint. The manipulation of the argument doctorname leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.
A vulnerability was determined in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This vulnerability affects unknown code of the file get_town.php of the component AJAX Endpoint. Executing a manipulation of the argument countryid/townid/cid/didval/cidval can lead to sql injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-105468 is a medium severity SQL injection vulnerability in the girishsaraf Online-Appointment-Booking-System. It affects the Login Handler component, specifically the mysqli_query function in Admin/mlogin.php. The vulnerability allows remote attackers to manipulate the uname/pass arguments to perform SQL injection. The product uses a rolling release model, so specific affected versions are not available. The issue was reported early but the project has not responded or issued a fix yet. Exploit code has been publicly disclosed.
CVE-2026-105387 is a medium severity SQL injection vulnerability in the girishsaraf Online-Appointment-Booking-System. It affects the Patient Login Handler component, specifically the mysqli_query function in cover.php, allowing remote attackers to manipulate the uname/psw parameters to execute SQL injection. The vulnerability is publicly known and exploit code has been released. The product uses rolling releases, so exact affected and fixed versions are not available. The vendor has not yet responded or provided a fix.