CVE-2025-65358
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
Edoc-doctor-appointment-system v1.0.1 contains an SQL injection vulnerability via the 'docid' parameter at /admin/appointment.php.
Risk Assessment
An attacker can exploit SQL injection to gain unauthorized access to the database, modify or disclose data, potentially compromising confidentiality and integrity.
Recommendation
Upgrade Edoc-doctor-appointment-system to a version that fixes the vulnerability or apply patches. Implement input validation and parameterized SQL queries.
Other vulnerabilities in Edoc-doctor-appointment-system
See all- CVE-2026-116112High
A vulnerability was identified in HashenUdara edoc-doctor-appointment-system in the file admin/add-new.php, where manipulation of the 'spec' argument leads to SQL injection. The attack can be performed remotely, and a publicly available exploit may be used. The product uses a rolling release model, so no version details are available.
- CVE-2025-66918High
edoc-doctor-appointment-system v1.0.1 is vulnerable to Cross Site Scripting (XSS) in admin/add-session.php via the "title" parameter.
Original NVD description (English source)
Edoc-doctor-appointment-system v1.0.1 was discovered to contain SQl injection vulnerability via the 'docid' parameter at /admin/appointment.php.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS