Doctor Appointment System 1.0 - SQL Injection

SQL injection in the expertise parameter in searchresult.php in Doctor Appointment System v1.0. id: CVE-2021-27124 info: name: Doctor Appointment System 1.0 - SQL Injection author: theamanrawat severity: medium description: | SQL injection in the expertise parameter in searchresult.php in Doctor...

Doctor Appointment System 1.0 - SQL Injection

Blind SQL injection in contactus.php in Doctor Appointment System 1.0 allows an unauthenticated attacker to insert malicious SQL queries via the comment parameter. id: CVE-2021-27315 info: name: Doctor Appointment System 1.0 - SQL Injection author: theamanrawat severity: high description: | Blind...

Doctor Appointment System 1.0 - SQL Injection

Blind SQL injection in contactus.php in doctor appointment system 1.0 allows an unauthenticated attacker to insert malicious SQL queries via lastname parameter. id: CVE-2021-27316 info: name: Doctor Appointment System 1.0 - SQL Injection author: theamanrawat severity: high description: | Blind SQ...

Doctor Appointment System 1.0 - SQL Injection

SQL injection in admin.php in doctor appointment system 1.0 allows an unauthenticated attacker to insert malicious SQL queries via username parameter at login page. id: CVE-2021-27314 info: name: Doctor Appointment System 1.0 - SQL Injection author: theamanrawat severity: critical description: |...

Doctor Appointment System 1.0 - SQL Injection

Blind SQL injection in contactus.php in Doctor Appointment System 1.0 allows an unauthenticated attacker to insert malicious SQL queries via firstname parameter. id: CVE-2021-27320 info: name: Doctor Appointment System 1.0 - SQL Injection author: theamanrawat severity: high description: | Blind S...

Doctor Appointment System 1.0 - SQL Injection

Blind SQL injection in contactus.php in Doctor Appointment System 1.0 allows an unauthenticated attacker to insert malicious SQL queries via email parameter. id: CVE-2021-27319 info: name: Doctor Appointment System 1.0 - SQL Injection author: theamanrawat severity: high description: | Blind SQL...

TrueBooker <= 1.0.2 - SQL Injection

The TrueBooker Appointment Booking and Scheduler Plugin. plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 1.0.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

CVE-2023-23397-POC

CVE-2023-23397-POC CVE-2023-23397 的利用 POC Appointment.cs : 来自 https://github.com/Sicos1977/MsgKit/blob/master/MsgKit/Appointment.cs 的修改文件 Exploit.cs : 我用于复制创建恶意约会的代码。我修改了 MDSEC...

CVE-2021-25791-Multiple-Stored-XSS

CVE-2021-25791-Multiple-Stored-XSS : 在线医生预约系统中的多个存储型XSS漏洞 在线医生预约系统V1.0中存在多个经身份验证的存储型跨站脚本漏洞 软件链接：https://www.sourcecodester.com/download-code?nid=14663&title=Online+Doctor+Appointment+System+in+PHP+with+Full+Source+Code https://vulners.com/cve/CVE-2021-25791...

CVE-2026-88995

The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.1 does not properly restrict the data returned by an availability-check request , allowing unauthenticated users to retrieve other customers' appointment details, including free-text booking comments and contact information...

CVE-2023-23397

CVE-2023-23397 CVE-2023-23397 C PoC 1- 下载 msgkit 2- 编辑约会类并添加以下内容： 3- 在项目中创建一个新类，用于设置 msg 文件的属性： root@kitploit: using MsgKit.Enums; using System; using System.Collections.Generic; using System.Linq; using System.Text; using System.Threading.Tasks; namespace MsgKit class Program static void...

CVE-2025-46181-XSS

CVE-2025-46181 - XSS reflejado en un sistema de reserva de citas en línea CVE-ID : CVE-2025-46181 Descubierto por : Shemkumar P shemkumar.github.io Tipo de vulnerabilidad : Cross-Site Scripting XSS reflejado Severidad : Media Estado : Divulgado, CVE asignado por MITRE ✨ Descripción Existe una...

CVE-2025-29448

CVE-2025-29448 描述 Easy!Appointments v1.5.1 中的预订逻辑缺陷允许未经身份验证的攻击者创建持续时间过长的预约，从而阻止所有未来的预订可用性，造成拒绝服务。 复现步骤 1. 拦截一个预约预订请求。 2. 在请求正文中找到 postdataappointmentenddatetime 参数。 3. 将参数值修改为未来的一个遥远日期并发送请求。 4. 应用程序接受该长时间预订，阻止了所有未来的可用性，造成拒绝服务。 修复提交...

CVE-2026-87891

The Rox Appointment Booking WordPress plugin before 1.2.0 does not perform any capability or authorization check when saving its holiday schedule, allowing unauthenticated attackers to overwrite the dates the booking system treats as unavailable, which can block legitimate bookings or open dates...

CVE-2026-87892

The Rox Appointment Booking WordPress plugin before 1.2.0 does not verify the order total or the selected payment method against its own server-side pricing when creating a booking, allowing unauthenticated attackers to create confirmed bookings at an arbitrary price and to bypass the site's...

CVE-2026-87894

The Rox Appointment Booking WordPress plugin before 1.2.3 does not perform any authorization check on the endpoint that returns a booking's confirmation details, and each booking is addressed by a sequential numeric identifier, allowing unauthenticated attackers to read any customer's name, email...

EUVD-2026-76803

The Rox Appointment Booking WordPress plugin before 1.2.0 does not verify the order total or the selected payment method against its own server-side pricing when creating a booking, allowing unauthenticated attackers to create confirmed bookings at an arbitrary price and to bypass the site's...

CVE-2026-87894 Rox Appointment Booking 1.0.9 - 1.2.2 - Unauthenticated Customer PII Disclosure via IDOR

The Rox Appointment Booking WordPress plugin before 1.2.3 does not perform any authorization check on the endpoint that returns a booking's confirmation details, and each booking is addressed by a sequential numeric identifier, allowing unauthenticated attackers to read any customer's name, email...

CVE-2026-87894

CVE-2026-87894 affects the Rox Appointment Booking WordPress plugin in versions 1.0.9 through 1.2.2 . The vulnerability is an Insecure Direct Object Reference (IDOR) : the endpoint that returns a booking's confirmation details performs no authorization check , and each booking is addressed by a s...

CVE-2026-87892 Rox Appointment Booking < 1.2.0 - Unauthenticated Price Manipulation and Payment Method Restriction Bypass

The Rox Appointment Booking WordPress plugin before 1.2.0 does not verify the order total or the selected payment method against its own server-side pricing when creating a booking, allowing unauthenticated attackers to create confirmed bookings at an arbitrary price and to bypass the site's...