Live › vulnerability › CVE-2026-116112
Go to dashboardThe edoc-doctor-appointment-system web app has an SQL injection flaw in admin/add-new.php via the spec argument. A remote attacker can run arbitrary SQL queries against the application's database, which can expose or alter stored patient and appointment data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 03:39 UTC. All times on this page are UTC.
Anyone running the edoc-doctor-appointment-system code at or before the listed commit with the admin pages reachable over the network. The sources state the attack is remote and the exploit is public, but they do not say whether login is required to reach admin/add-new.php. Teams that do not run this project can skip it.
No product ranges from the sources yet.
admin/add-new.php from HashenUdara edoc-doctor-appointment-system at or before commit cc258425b915d1af9e298777ccd26d160493e68dEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was identified in HashenUdara edoc-doctor-appointment-system up to cc258425b915d1af9e298777ccd26d160493e68d. The affected element is an unknown function of the file admin/add-new.php. The manipulation of the argument spec leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · in your agent: get_signal("CVE-2026-116112")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.