CVE-2026-19839

CVE-2026-19839 affects SourceCodester Simple Doctors Appointment System 1.0. The vulnerability is in the function save_doctor of /save_file.php, enabling unrestricted file upload via remote attack; exploitation is publicly available per the provided descriptions. No remediation steps or fixed ver...

WordPress Amelia plugin < 2.4.6 - Provider+ Cross-Customer Appointment Data Disclosure via IDOR vulnerability

Provider+ Cross-Customer Appointment Data Disclosure via IDOR vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Amelia versions 2.4.6...

PT-2026-72050

Name of the Vulnerable Software and Affected Versions SourceCodester Simple Doctors Appointment System version 1.0 Description An unrestricted upload issue exists in the /save file.php endpoint within the save doctor function. This flaw allows a remote attacker to upload files without proper...

CVE-2026-66462

Unauthenticated Sensitive Data Exposure in WooCommerce Appointments = 5.3.8 versions...

EUVD-2026-57881

Unauthenticated Sensitive Data Exposure in WooCommerce Appointments = 5.3.8 versions...

WordPress KiviCare plugin < 4.5.2 - Patient+ Cross-Patient Bill, Invoice and Appointment Disclosure via IDOR vulnerability

Patient+ Cross-Patient Bill, Invoice and Appointment Disclosure via IDOR vulnerability discovered by Sai Praneeth Koti in WordPress Plugin KiviCare versions 4.5.2...

CVE-2026-14213 Amelia < 2.4.6 - Provider+ Cross-Customer Appointment Data Disclosure via IDOR

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.6 does not verify that an authenticated employee provider is assigned to the appointment being accessed, allowing any employee to read any appointment by its identifier and disclose the booked customer's personal data...

CVE-2026-14213

CVE-2026-14213 affects the WordPress plugin Booking for Appointments and Events Calendar up to version 2.4.6. The issue is an access control flaw: an authenticated provider can access appointments they are not assigned to, enabling an attacker to read any appointment by its identifier and exposur...

EUVD-2026-57727

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.6 does not verify that an authenticated employee provider is assigned to the appointment being accessed, allowing any employee to read any appointment by its identifier and disclose the booked customer's personal data...

PT-2026-71568

Unauthenticated Sensitive Data Exposure in WooCommerce Appointments = 5.3.8 versions...

CVE-2026-13612

The KiviCare WordPress plugin before 4.5.2 does not verify that the requesting user owns the records being accessed, allowing authenticated patient-level users to read other patients' bills, invoices and appointment details...

CVE-2026-13612

KiviCare WordPress plugin prior to 4.5.2 contains an IDOR flaw: it does not verify that the requesting user owns the accessed records, enabling authenticated patient users to read other patients’ bills, invoices, and appointment details. The issue affects the module handling bills/invoices/appoin...

CVE-2026-13612

The KiviCare WordPress plugin before 4.5.2 does not verify that the requesting user owns the records being accessed, allowing authenticated patient-level users to read other patients' bills, invoices and appointment details...

CVE-2026-19384

A weakness has been identified in SourceCodester Simple Doctors Appointment System 1.0. The affected element is an unknown function of the file /admin/ajax.php?action=setappointment. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has...

CVE-2026-19384

CVE-2026-19384 affects SourceCodester Simple Doctors Appointment System 1.0. The vulnerability is an SQL injection in the admin/ajax.php?action=set_appointment path, caused by manipulating the argument ID in an unknown function. The issue can be remotely exploitable, and public exploits/PoC are n...

CVE-2026-19384

A weakness has been identified in SourceCodester Simple Doctors Appointment System 1.0. The affected element is an unknown function of the file /admin/ajax.php?action=setappointment. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has...

EUVD-2026-54983

A weakness has been identified in SourceCodester Simple Doctors Appointment System 1.0. The affected element is an unknown function of the file /admin/ajax.php?action=setappointment. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has...

CVE-2026-19384 SourceCodester Simple Doctors Appointment System ajax.php set_appointment sql injection

A weakness has been identified in SourceCodester Simple Doctors Appointment System 1.0. The affected element is an unknown function of the file /admin/ajax.php?action=setappointment. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has...

PT-2026-69328

Name of the Vulnerable Software and Affected Versions SourceCodester Simple Doctors Appointment System version 1.0 Description A SQL injection flaw exists that allows remote attackers to manipulate the ID argument. This issue occurs within an unknown function in the '/admin/ajax.php?action=set...

CVE-2026-16282

The Appointment Hour Booking WordPress plugin before 1.5.88 does not validate a client-supplied booking price against the server-side configured service price, allowing unauthenticated users to submit an arbitrary final price including zero or negative that is stored as the authoritative booking...