Description
A vulnerability was determined in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected by this issue is some unknown functionality of the file Admin/showdoctor.php of the component Admin Display Pages. This manipulation causes missing authorization. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-10-13
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: Unauthorized Access via missing admin authorization
Action: Assess Impact
AI Analysis

Impact

The vulnerability resides in the Admin/showdoctor.php component of the Online‑Appointment‑Booking‑System, where missing authorization checks allow an attacker to manipulate the page and gain unauthorized access. This can lead to viewing or modifying sensitive appointment data, potentially escalating privileges within the system. The flaw is a classic authorization bypass, as identified by CWE-862 and CWE-863, meaning the attack does not require authentication to succeed once the URL is known.

Affected Systems

Affecting all deployments of girishsaraf's Online‑Appointment‑Booking‑System, with no specific release notes due to a rolling‑release model. Versions up to the commit f427b4757128ca253d33d0cc4e87bbb9c999a4d5 contain the flaw, and any newer releases have not been confirmed to include remediation.

Risk and Exploitability

The CVSS score of 6.9 indicates a moderate risk, and the EPSS score is not available. The vulnerability is publicly disclosed and exploitable through a remote web request. It is not listed in the CISA KEV catalog, but the lack of a patch and the remote nature of the exploit raise substantial concern for any active deployment.

Generated by OpenCVE AI on October 13, 2026 at 17:00 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Restrict access to the Admin/showdoctor.php page to authenticated administrators only using proper authentication mechanisms.
  • Implement network‑level restrictions such as firewall rules or VPN requirements to limit exposure of admin pages.
  • Monitor the project’s repository and CVE feeds for a vendor‑issued fix, and apply it as soon as it becomes available.

Generated by OpenCVE AI on October 13, 2026 at 17:00 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected by this issue is some unknown functionality of the file Admin/showdoctor.php of the component Admin Display Pages. This manipulation causes missing authorization. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.
Title girishsaraf Online-Appointment-Booking-System Admin Display Pages showdoctor.php authorization
First Time appeared Girishsaraf
Girishsaraf online-appointment-booking-system
Weaknesses CWE-862
CWE-863
CPEs cpe:2.3:a:girishsaraf:online-appointment-booking-system:*:*:*:*:*:*:*:*
Vendors & Products Girishsaraf
Girishsaraf online-appointment-booking-system
References
Metrics cvssV2_0

{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 5.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Girishsaraf Online-appointment-booking-system
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-13T15:00:14.312Z

Reserved: 2026-10-12T19:04:25.647Z

Link: CVE-2026-109524

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-13T16:17:17.847

Modified: 2026-10-13T16:17:17.847

Link: CVE-2026-109524

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T17:15:15Z

Weaknesses