CVE-2021-36622

The CVE-2021-36622 entry concerns Sourcecodester Online Covid Vaccination Scheduler System 1.0, which is affected by an Arbitrary File Upload vulnerability. The admin panel allows profile photo uploads at /scheduler/admin/?page=user, enabling an attacker to upload a file like shell.php with Conte...

CVE-2021-36621

CVE-2021-36621 affects Sourcecodester Online Covid Vaccination Scheduler System 1.0. The vulnerability is a SQL Injection in the username parameter, described as a time-based injection that can dump the admin password hash and allow an attacker to decrypt it to obtain the plaintext password, enab...

CVE-2021-41930

The CVE-2021-41930 entry concerns a Cross-Site Scripting (XSS) vulnerability in SourceCodester’s Online Covid Vaccination Scheduler System v1 (developer: oretnom23). The issue arises from lack of escaping/filtering of data in the lid parameter passed to /scheduler/addSchedule.php, enabling arbitr...

CVE-2021-37803

CVE-2021-37803: A SQL Injection vulnerability exists in Sourcecodester Online Covid Vaccination Scheduler System 1.0, exploitable via the username parameter in login.php (lognin.php). The issue is exposed over network with no authentication required (per CVSS v3.1: AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H...