edoc-doctor-appointment-system vulnerabilities

3 known CVE vulnerabilities in edoc-doctor-appointment-system, translated and rated.

CVE-2025-65358Critical
Edoc-doctor-appointment-system v1.0.1 contains an SQL injection vulnerability via the 'docid' parameter at /admin/appointment.php.
CVE-2026-116112High
A vulnerability was identified in HashenUdara edoc-doctor-appointment-system in the file admin/add-new.php, where manipulation of the 'spec' argument leads to SQL injection. The attack can be performed remotely, and a publicly available exploit may be used. The product uses a rolling release model, so no version details are available.
CVE-2025-66918High
edoc-doctor-appointment-system v1.0.1 is vulnerable to Cross Site Scripting (XSS) in admin/add-session.php via the "title" parameter.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS