CVE-2022-36543

Edoc-doctor-appointment-system v1.0.1 was discovered to contain a SQL injection vulnerability via the id parameter at /patient/doctors.php...

CVE-2022-36543

Edoc-doctor-appointment-system v1.0.1 was discovered to contain a SQL injection vulnerability via the id parameter at /patient/doctors.php...

Sql injection

Edoc-doctor-appointment-system v1.0.1 was discovered to contain a SQL injection vulnerability via the id parameter at /patient/booking.php...

Design/Logic Flaw

An access control issue in the component /ip/admin/ of Edoc-doctor-appointment-system v1.0.1 allows attackers to arbitrarily edit, read, and delete Administrator data...

Sql injection

Edoc-doctor-appointment-system v1.0.1 was discovered to contain a SQL injection vulnerability via the id parameter at /patient/doctors.php...

Sql injection

Edoc-doctor-appointment-system v1.0.1 was discovered to contain a SQL injection vulnerability via the id parameter at /patient/settings.php...

CVE-2022-36548

Edoc-doctor-appointment-system v1.0.1 was discovered to contain a stored cross-site scripting XSS vulnerability at /patient/settings.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name text field...

CVE-2022-36547

Edoc-doctor-appointment-system v1.0.1 was discovered to contain a reflected cross-site scripting XSS vulnerability at /patient/index.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Search field...

CVE-2022-36546

Edoc-doctor-appointment-system v1.0.1 contains a Cross-Site Request Forgery (CSRF) vulnerability in the /patient/settings.php endpoint. The issue allows potentially malicious requests to be performed on behalf of a logged-in user. CVSS 3.1 base score 8.8 (HIGH); attack vector Network, privileges ...

CVE-2022-36546

Edoc-doctor-appointment-system v1.0.1 was discovered to contain a Cross-Site Request Forgery CSRF via /patient/settings.php...

CVE-2022-36545

Edoc-doctor-appointment-system v1.0.1 was discovered to contain a SQL injection vulnerability via the id parameter at /patient/settings.php...

CVE-2022-36545

Edoc-doctor-appointment-system v1.0.1 contains a SQL injection vulnerability via the id parameter in /patient/settings.php. The issue is documented in CVE-2022-36545 and is assessed with a CVSS v3.1 base score of 9.8 (CRITICAL), with network access, no privileges required, and no user interaction...

CVE-2022-36543

Edoc-doctor-appointment-system v1.0.1 was discovered to contain a SQL injection vulnerability via the id parameter at /patient/doctors.php...

CVE-2022-36544

Edoc-doctor-appointment-system v1.0.1 was discovered to contain a SQL injection vulnerability via the id parameter at /patient/booking.php...

CVE-2022-36543

The affected software is Edoc-doctor-appointment-system v1.0.1. A SQL injection vulnerability exists in the endpoint /patient/doctors.php, exploitable via the id parameter. The Root Cause, as stated across sources, is an injection flaw in handling the id parameter, enabling potentially arbitrary ...

CVE-2022-36544

CVE-2022-36544 affects the Edoc-doctor-appointment-system v1.0.1, with a SQL injection vulnerability via the id parameter in /patient/booking.php. Root cause: improper handling of the id value leading to injection into SQL queries. Impact: high confidentiality, integrity, and availability impacts...

CVE-2022-36542

An access control issue in the component /ip/admin/ of Edoc-doctor-appointment-system v1.0.1 allows attackers to arbitrarily edit, read, and delete Administrator data...

CVE-2022-36542

Edoc-doctor-appointment-system v1.0.1 has an access control vulnerability in the /ip/admin/ component that allows attackers to arbitrarily edit, read, and delete Administrator data. The issue is described across multiple sources (NVD/Red Hat/PRION/etc.), with CVSS 3.1 characteristics indicating n...

CVE-2022-36544: Improper Neutralization of Special Elements used in an SQL Command

Edoc-doctor-appointment-system v1.0.1 was discovered to contain a SQL injection vulnerability via the id parameter at /patient/booking.php...

PT-2022-23456 · Unknown · Edoc-Doctor-Appointment-System

Name of the Vulnerable Software and Affected Versions: Edoc-doctor-appointment-system version 1.0.1 Description: A SQL injection issue was found in the Edoc-doctor-appointment-system via the id parameter at the "/patient/booking.php" API endpoint. Recommendations: For Edoc-doctor-appointment-syst...