CVE-2026-109525: fallo de gravedad media en girishsaraf Online-Appointment-Booking-System
girishsaraf Online-Appointment-Booking-System submit2 changebookingstatus.php authorization
Publicada el
33Vexday Risk Score
Sin señal de explotación. Ella tiene prueba de concepto pública.
ssvc Attendcvss 6.9epss 0.3%
probabilidad de explotación
0.3%top 80% de las CVE
explotación observada
noninguna fuente lo reporta
1 exploit(s) público(s)
A vulnerability was identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects an unknown part of the file changebookingstatus.php of the component submit2 Handler. Such manipulation of the argument username[]/timestamp[]/status[] leads to missing authorization. The attack may be performed from remote. The exploit is publicly available and might be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Productos afectados
girishsaraf · Online-Appointment-Booking-SystemPoCs públicas encontradas — 1
cve_referencegithub.com/girishsaraf/Online-Appointment-Booking-System/issues/15no verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — girishsaraf Online-Appointment-Booking-System
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-109524MEDIUMgirishsaraf Online-Appointment-Booking-System Admin Display Pages showdoctor.php authorizationEPSS 0.5%CVE-2026-109522MEDIUMgirishsaraf Online-Appointment-Booking-System Admin CRUD Endpoint deleteclinic.php sql injectionEPSS 0.4%CVE-2026-109521MEDIUMgirishsaraf Online-Appointment-Booking-System changebookingstatus.php sql injectionEPSS 0.4%CVE-2026-105469MEDIUMgirishsaraf Online-Appointment-Booking-System AJAX Endpoint get_town.php sql injectionEPSS 0.3%CVE-2026-105387MEDIUMgirishsaraf Online-Appointment-Booking-System Patient Login cover.php mysqli_query sql injectionEPSS 0.3%CVE-2026-109523MEDIUMgirishsaraf Online-Appointment-Booking-System AJAX Endpoint getclinic.php sql injectionEPSS 0.3%