CVE-2022-36544

CVE-2022-36544 affects the Edoc-doctor-appointment-system v1.0.1, with a SQL injection vulnerability via the id parameter in /patient/booking.php. Root cause: improper handling of the id value leading to injection into SQL queries. Impact: high confidentiality, integrity, and availability impacts...

CVE-2022-36542

An access control issue in the component /ip/admin/ of Edoc-doctor-appointment-system v1.0.1 allows attackers to arbitrarily edit, read, and delete Administrator data...

CVE-2022-36542

Edoc-doctor-appointment-system v1.0.1 has an access control vulnerability in the /ip/admin/ component that allows attackers to arbitrarily edit, read, and delete Administrator data. The issue is described across multiple sources (NVD/Red Hat/PRION/etc.), with CVSS 3.1 characteristics indicating n...

PT-2022-23454

Name of the Vulnerable Software and Affected Versions Edoc-doctor-appointment-system version 1.0.1 Description An access control issue in the component /ip/admin/ allows attackers to arbitrarily edit, read, and delete Administrator data. Recommendations For Edoc-doctor-appointment-system version...

PT-2022-23456 · Unknown · Edoc-Doctor-Appointment-System

Name of the Vulnerable Software and Affected Versions: Edoc-doctor-appointment-system version 1.0.1 Description: A SQL injection issue was found in the Edoc-doctor-appointment-system via the id parameter at the "/patient/booking.php" API endpoint. Recommendations: For Edoc-doctor-appointment-syst...

Edoc-doctor-appointment-system 安全漏洞

Edoc-doctor-appointment-system is a simple web project for e-channels by HashenUdara Personal Developer. A security vulnerability exists in Edoc-doctor-appointment-system version v1.0.1, which stems from an access control issue in the component /ip/admin/. An attacker can exploit the vulnerabilit...

Edoc-doctor-appointment-system SQL注入漏洞

Edoc-doctor-appointment-system is a simple web project for e-access by HashenUdara Personal Developer. A security vulnerability exists in Edoc-doctor-appointment-system version v1.0.1, which stems from the discovery of a SQL injection vulnerability via the id parameter in /patient/settings.php...

PT-2022-23458 · Unknown · Edoc-Doctor-Appointment-System

Name of the Vulnerable Software and Affected Versions: Edoc-doctor-appointment-system version 1.0.1 Description: The Edoc-doctor-appointment-system contains a Cross-Site Request Forgery CSRF issue via the "/patient/settings.php" API endpoint. This allows for potentially malicious requests to be...

PT-2022-23455

Name of the Vulnerable Software and Affected Versions Edoc-doctor-appointment-system version 1.0.1 Description The Edoc-doctor-appointment-system contains a SQL injection issue via the id parameter at the "/patient/doctors.php" API endpoint. Recommendations For Edoc-doctor-appointment-system...

Edoc-doctor-appointment-system SQL注入漏洞

Edoc-doctor-appointment-system is a simple web project for e-access by HashenUdara Personal Developer. A security vulnerability exists in Edoc-doctor-appointment-system version v1.0.1, which stems from the discovery of a SQL injection vulnerability via the id parameter in /patient/doctors.php...

PT-2022-23460

Name of the Vulnerable Software and Affected Versions Edoc-doctor-appointment-system version 1.0.1 Description The issue is related to a stored cross-site scripting XSS vulnerability. This vulnerability is located at the "/patient/settings.php" API endpoint and allows attackers to execute arbitra...

Edoc-doctor-appointment-system 跨站脚本漏洞

Edoc-doctor-appointment-system is a simple web project for e-access by HashenUdara Personal Developer. A security vulnerability exists in Edoc-doctor-appointment-system version v1.0.1, which stems from the discovery of a reflected cross-site scripting vulnerability via /patient/index.php. An...

MAL-2022-646 Malicious code in @tinkoff-component/appointment (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3faf95ed10405c227dbb4de41f7ba1581c83b166b95d235ff3691644ee8d9b0b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @tinkoff-component/appointment (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3faf95ed10405c227dbb4de41f7ba1581c83b166b95d235ff3691644ee8d9b0b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WordPress Appointment Hour Booking plugin跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plug-in. A cross-site scripting vulnerability exists in versions of WordPress prior to Appointment Hour Booking plugi...

CVE-2022-1710

The Appointment Hour Booking WordPress plugin before 1.3.56 does not sanitise and escape a settings of its Calendar fields, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml is disallowed...

CVE-2022-1710

The Appointment Hour Booking WordPress plugin before 1.3.56 does not sanitise and escape a settings of its Calendar fields, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml is disallowed...

CVE-2022-1710

The Appointment Hour Booking WordPress plugin before 1.3.56 does not sanitise and escape a settings of its Calendar fields, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml is disallowed...

CVE-2022-1710 Appointment Hour Booking < 1.3.56 - Admin+ Stored Cross-Site Scripting

The Appointment Hour Booking WordPress plugin before 1.3.56 does not sanitise and escape a settings of its Calendar fields, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml is disallowed...

CVE-2022-1710

The CVE-2022-1710 entry concerns the WordPress Appointment Hour Booking plugin prior to version 1.3.56. The vulnerability arises from insufficient sanitization/escaping of the Calendar fields settings, enabling stored Cross-Site Scripting (XSS) by high-privilege users. Affected component: the plu...