CVE-2022-36201

Doctor’s Appointment System v1.0 is vulnerable to Blind SQLi via settings.php...

CVE-2022-36203

Doctor's Appointment System 1.0 is vulnerable to Cross Site Scripting XSS via the admin panel. In addition, it leads to takeover the administrator account by stealing the cookie via XSS...

Design/Logic Flaw

Doctor’s Appointment System v1.0 is vulnerable to Blind SQLi via settings.php...

CVE-2022-36201

CVE-2022-36201 affects Doctor’s Appointment System v1.0. A blind SQL injection vulnerability exists in settings.php and is also exploitable via the id parameter in booking.php, enabling attackers to potentially access or modify data. The issue is documented with a high severity (CVSS v3.1: 9.8, c...

CVE-2022-36201

Doctor’s Appointment System v1.0 is vulnerable to Blind SQLi via settings.php...

CVE-2022-36202

CVE-2022-36202 affects Doctor's Appointment System1.0, specifically the edoc/patient/settings.php component. The vulnerability is an IDOR/Broken Access Control in the id= parameter, enabling unauthorized access to settings. The CVSS v3.1 base score is 9.8 (CRITICAL) with NETWORK attack vector, an...

CVE-2022-36203

Doctor's Appointment System 1.0 is vulnerable to Cross Site Scripting XSS via the admin panel. In addition, it leads to takeover the administrator account by stealing the cookie via XSS...

CVE-2022-36203

CVE-2022-36203 involves Doctor’s Appointment System version 1.0 and describes a Cross-Site Scripting (XSS) vulnerability in the admin panel that can result in taking over the administrator account by stealing the cookie. The vulnerability is documented with a CVSS v3.1 base score of 6.1 (Medium) ...

Doctor’s Appointment System 安全漏洞

Doctor's Appointment System is a doctor's appointment system by Hashen Udara, an individual developer. A security vulnerability exists in Doctor's Appointment System version 1.0, which stems from an incorrect access control in its edoc/patient/settings.php that results in an interrupted access...

Doctor’s Appointment System SQL注入漏洞

Doctor's Appointment System is a doctor's appointment system by Hashen Udara, an individual developer. Doctor's Appointment System version 1.0 suffers from a SQL injection vulnerability that originates from an attacker being able to achieve SQL injection via the ?id= parameter of its booking.php...

PT-2022-23259 · Unknown · Doctor Appointment System

Name of the Vulnerable Software and Affected Versions: Doctor's Appointment System version 1.0 Description: The issue allows for Cross Site Scripting XSS via the admin panel, which can lead to the takeover of the administrator account by stealing the cookie via XSS. Recommendations: For Doctor's...

PT-2022-23257 · Unknown · Doctor Appointment System

Name of the Vulnerable Software and Affected Versions: Doctor’s Appointment System version 1.0 Description: The issue concerns a Blind SQL Injection vulnerability. It is exploitable via the settings.php file and also through the booking.php file, where the id parameter is vulnerable...

PT-2022-23258 · Unknown · Doctor Appointment System

Name of the Vulnerable Software and Affected Versions: Doctor's Appointment System version 1.0 Description: The issue concerns Incorrect Access Control, specifically Broken Access Control IDOR, in the settings.php file located at the /edoc/patient/ endpoint. The vulnerability is exploited via the...

Doctor’s Appointment System 跨站脚本漏洞

Doctor's Appointment System is a doctor's appointment system by Hashen Udara, an individual developer. A security vulnerability exists in Doctor's Appointment System version 1.0, which stems from its admin panel allowing an attacker to steal a cookie to take over the administrator account...

CVE-2022-36546

Edoc-doctor-appointment-system v1.0.1 was discovered to contain a Cross-Site Request Forgery CSRF via /patient/settings.php...

CVE-2022-36544

Edoc-doctor-appointment-system v1.0.1 was discovered to contain a SQL injection vulnerability via the id parameter at /patient/booking.php...

CVE-2022-36545

Edoc-doctor-appointment-system v1.0.1 was discovered to contain a SQL injection vulnerability via the id parameter at /patient/settings.php...

CVE-2022-36544

Edoc-doctor-appointment-system v1.0.1 was discovered to contain a SQL injection vulnerability via the id parameter at /patient/booking.php...

CVE-2022-36545

Edoc-doctor-appointment-system v1.0.1 was discovered to contain a SQL injection vulnerability via the id parameter at /patient/settings.php...

CVE-2022-36548

Edoc-doctor-appointment-system v1.0.1 was discovered to contain a stored cross-site scripting XSS vulnerability at /patient/settings.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name text field...