CVE-2022-40471

CVE-2022-40471 affects Clinic's Patient Management System v1.0. The flaw is an unrestricted file upload in the profile image handling (users.php) that allows uploading PHP web shells, enabling remote command execution. Connected documents provide exploit modules demonstrating RCE via the profile-...

CVE-2022-2297

CVE-2022-2297 affects SourceCodester Clinics Patient Management System 2.0. An unrestricted file upload vulnerability exists in the update_user.php?user_id=1 flow where manipulating the profile_picture parameter with input like enables remote code execution. Public PoCs and exploit activity are ...

CVE-2023-1035

CVE-2023-1035 affects SourceCodester Clinics Patient Management System 1.0, with a vulnerability in the update_user.php code path. The issue originates from manipulation of the user_id argument, enabling SQL injection that can be triggered remotely. Exploitation information indicates the vulnerab...

CVE-2022-2298

CVE-2022-2298 affects SourceCodester Clinics Patient Management System 2.0, specifically the Login Page at /pms/index.php. The vulnerability arises from an injectable user_name parameter; input like admin' or '1'='1 can trigger SQL injection. Exploitation can be performed remotely, and public PoC...

CVE-2022-36750

CVE-2022-36750 : Clinic’s Patient Management System v1.0 is vulnerable to SQL injection through /pms/update_user.php?id=. The CVSS 3.1 base score is 9.8 (CRITICAL) with network attack vector, low complexity, and no privileges required. Affected component is the update_user endpoint handling the i...

CVE-2022-3120

SourceCodester Clinics Patient Management System is affected by CVE-2022-3120 in the Login component (index.php). The vulnerability is a SQL injection caused by the manipulation of the user_name parameter, enabling remote exploitation. The entry notes that the exploit has been disclosed publicly....

CVE-2022-3122

CVE-2022-3122 affects SourceCodester Clinics Patient Management System v1.0, with a SQL injection in the file medicine_details.php triggered by the medicine parameter. The issue can be exploited remotely and has been publicly disclosed. Affected component is the unknown functionality of medicine_...

CVE-2024-6969

CVE-2024-6969 concerns SourceCodester Clinics Patient Management System 1.0. The issue is a SQL injection in an endpoint handling /ajax/get_patient_history.php, triggered by manipulating the patient_id parameter. This can be exploited remotely and is described as a critical vulnerability with pub...

CVE-2022-36251

CVE-2022-36251 affects Clinic's Patient Management System v1.0 with a Cross Site Scripting (XSS) vulnerability in patients.php. The issue arises from improper handling of input, enabling injection of scripts by an attacker. CVSSv3.1 base score 6.1 (Medium) with network attack vector, low attack c...

CVE-2024-7930

SourceCodester Clinics Patient Management System 1.0 contains a SQL injection in /pms/ajax/get_packings.php via the medicine_id parameter. The vulnerability enables remote exploitation and is documented across multiple sources (NVD, CVE list, Red Hat, CNNVD, etc.), with exploit publicly disclosed...

CVE-2024-6968

The CVE-2024-6968 entry affects SourceCodester Clinics Patient Management System 1.0, with the vulnerability residing in the /print_patients_visits.php file. The issue allows SQL injection via manipulation of the from/to argument and can be exploited remotely; the exploit has been disclosed publi...

CVE-2022-35117

CVE-2022-35117 affects Clinic's Patient Management System v1.0. The vulnerability is a cross-site scripting (XSS) flaw exploitable via update_medicine_details.php, where an attacker can inject a crafted payload into the Packing text box in the Update Medical Details module to execute arbitrary we...

CVE-2022-36242

Clinic's Patient Management System v1.0 is affected by an SQL Injection via /pms/update_medicine.php?id= (root cause: unsafely handled id parameter). The CVE entries (CVE-2022-36242) cite a high-severity impact (CVSS 3.1 base 9.8; Confidentiality, Integrity, Availability all High) with network ac...

CVE-2022-36609

Clinic's Patient Management System v1.0 contains a SQL injection vulnerability in the id parameter of /pms/update_patient.php, due to lack of input validation for external SQL statements. The affected component is the pms update endpoint, enabling attackers to potentially execute arbitrary SQL an...

CVE-2024-7753

SourceCodester Clinics Patient Management System 1.0 contains a vulnerability in the /user_images/ path that can be triggered remotely via an unauthorized direct request. The issue affects unknown code in that file, and the exploit has been disclosed publicly. CVSS context in the record indicates...

CVE-2024-7841

CVE-2024-7841 affects SourceCodester Clinics Patient Management System 1.0. The vulnerability lies in /pms/ajax/check_user_name.php where manipulating the user_name parameter enables SQL injection. The attack can be initiated remotely and the exploit has been disclosed publicly; remediation is no...

CVE-2024-7752

The CVE-2024-7752 vulnerability affects SourceCodester Clinics Patient Management System v1.0 in the update_medicine.php component, where manipulation of the medicine_name parameter enables cross-site scripting (XSS). Exploitation is actionable remotely, and public disclosures exist. No product v...

CVE-2024-7751

CVE-2024-7751 corresponds to a SQL injection in SourceCodester Clinics Patient Management System 1.0, caused by manipulation of the hidden_id parameter in the file /update_medicine.php. Connected documents corroborate a remotely launchable vulnerability with publicly disclosed exploit details. Af...

CVE-2024-8554

CVE-2024-8554 affects SourceCodester Clinics Patient Management System 2.0. The vulnerable component is the /users.php file, where manipulating the message parameter yields cross-site scripting. The issue enables remote exploitation and the exploit has been disclosed publicly. Public-facing explo...

CVE-2024-8555

CVE-2024-8555 affects SourceCodester Clinics Patient Management System 2.0. The vulnerability is an open redirect in the file congratulations.php caused by manipulation of the goto_page parameter. It can be exploited remotely; the exploit has been disclosed publicly. The provided documents do not...

CVE-2024-8565

CVE-2024-8565 is a SQL injection vulnerability in SourceCodesters Clinics Patient Management System 2.0. The flaw resides in the /print_diseases.php endpoint, where manipulating the parameters disease/from/to enables remote exploitation. The issue affects processing of that file and is described ...

CVE-2024-7750

Concrete details found: CVE-2024-7750 affects SourceCodester Clinics Patient Management System 1.0, vulnerable through /medicines.php via the medicine_name parameter leading to SQL injection. The vulnerability is exploitable remotely and exploits have been disclosed publicly. Root cause is a SQL ...

CVE-2024-7645

CVE-2024-7645 concerns SourceCodester Clinics Patient Management System 1.0. The User Page component (users.php) is vulnerable to cross-site request forgery. It can be initiated remotely, with the exploit disclosed publicly. Several sources corroborate the CSRF issue in the users.php module. Reme...

CVE-2022-36270

CVE-2022-36270 affects Clinic's Patient Management System v1.0. The issue is an arbitrary code execution vulnerability exploitable via a crafted request to ip/pms/users.php, leading to high-impact outcomes (confidentiality, integrity, and availability). The CVE entry lists a NVD CVSS v3.1 base sc...

CVE-2024-7754

SourceCodester Clinics Patient Management System 1.0 contains a SQL injection vulnerability in /ajax/check_medicine_name.php via the user_name parameter. The issue is remote-exploitable and has been publicly disclosed. Several sources (including PT Security and other CVE aggregations) corroborate...

CVE-2024-7454

The CVE-2024-7454 entry concerns SourceCodester Clinics Patient Management System 1.0, where the vulnerable component is the function patient_name in patients.php. The root cause is an SQL injection vulnerability that can be triggered remotely, potentially leading to data exposure or modification...

CVE-2024-7494

CVE-2024-7494 affects SourceCodester Clinics Patient Management System 1.0. The vulnerability exists in /new_prescription.php where the patient parameter is manipulated to trigger a SQL injection. It can be exploited remotely and has been disclosed publicly. The issue impacts confidentiality, int...