Paper/Archive/CVE-2026-4473

CVE-2026-4473

itsourcecode Online Doctor Appointment System — itsourcecode Online Doctor Appointment System appointment_action.php sql injection

EPSS 0.3%public exploit CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 26.7.267 × 205.3 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

A vulnerability was detected in itsourcecode Online Doctor Appointment System 1.0. This issue affects some unknown processing of the file /admin/appointment_action.php. The manipulation of the argument appointment_id results in sql injection. The attack can be launched remotely. The exploit is now public and may be used.

Affected

ProductAffectedFixed inSource

Online Doctor Appointment System1.0–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

VulDB (CNA)5.1CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

VulDB (CNA)4.7CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

VulDB (CNA)4.7CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: partial

References

writeupvuldb.com/?id.351763 refvuldb.com/?ctiid.351763 writeupvuldb.com/?submit.772883 exploitgithub.com/sjkdhl/public/issues/2 refitsourcecode.com