CVE-2026-19416 KiviCare < 4.5.4 - Patient+ Cross-Patient Appointment Modification via IDOR

The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user owns the appointment being modified, allowing authenticated patient-level users to cancel and reschedule other patients' appointments...

CVE-2026-66679

Unauthenticated Broken Access Control in Appointment Hour Booking = 1.5.91 versions...

CVE-2026-14221: Improper Access Control

The Easy Appointments WordPress plugin through 4.0 does not perform capability checks in several of its appointment-management actions, relying only on a nonce that any authenticated user can obtain, allowing users with contributor-level access to read all customers' appointment details and to...

PT-2026-32641

CVE-2026-37601 SourceCodester Patient Appointment Scheduler System v1.0 is vulnerable to SQL Injection in the file /scheduler/admin/appointments/manage appointment.php. https://t.co/UmuQdNNj6l...

CVE-2022-0825

The Amelia WordPress plugin before 1.0.49 does not have proper authorisation when managing appointments, allowing any customer to update other's booking status, as well as retrieve sensitive information about the bookings, such as the full name and phone number of the person who booked it...

EUVD-2022-48589

Malicious code in bioql PyPI...

EUVD-2022-48588

Malicious code in bioql PyPI...

EUVD-2022-48587

Malicious code in bioql PyPI...

EUVD-2022-15793

Malicious code in bioql PyPI...

EUVD-2024-32843

Malicious code in bioql PyPI...

EUVD-2024-32844

Malicious code in bioql PyPI...

EUVD-2025-22940

Malicious code in bioql PyPI...

CVE-2025-9933

A vulnerability has been found in PHPGurukul Beauty Parlour Management System 1.1. Affected by this issue is some unknown functionality of the file /admin/view-appointment.php. Such manipulation of the argument viewid leads to sql injection. The attack may be launched remotely. The exploit has be...

CVE-2025-45805: Improper Neutralization of Input During Web Page Generation

In phpgurukul Doctor Appointment Management System 1.0, an authenticated doctor user can inject arbitrary JavaScript code into their profile name. This payload is subsequently rendered without proper sanitization, when a user visits the website and selects the doctor to book an appointment...

CVE-2025-50493

Improper session invalidation in the component /doctor/change-password.php of PHPGurukul Doctor Appointment Management System v1 allows attackers to execute a session hijacking attack...

CVE-2025-50493

Improper session invalidation in the component /doctor/change-password.php of PHPGurukul Doctor Appointment Management System v1 allows attackers to execute a session hijacking attack...

CVE-2025-50493

Improper session invalidation in the component /doctor/change-password.php of PHPGurukul Doctor Appointment Management System v1 allows attackers to execute a session hijacking attack...

CVE-2025-50493: Improper Input Validation

Improper session invalidation in the component /doctor/change-password.php of PHPGurukul Doctor Appointment Management System v1 allows attackers to execute a session hijacking attack...

CVE-2025-50493

Improper session invalidation in the component /doctor/change-password.php of PHPGurukul Doctor Appointment Management System v1 allows attackers to execute a session hijacking attack...

Malicious code in patient-appointment-management (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0fb18be6d022e135df2a66c90067908650077628db97d427a1058b8d3877bae6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...