The SourceCodester Patient Appointment Scheduler System version 1.0 contains an SQL injection vulnerability in the file /scheduler/admin/appointments/manage_appointment.php. A crafted request can be inserted into SQL statements, allowing an attacker to read, modify or delete appointment data stored in the database. This flaw can compromise the confidentiality, integrity, and availability of patient scheduling information.

The only identified product is SourceCodester Patient Appointment Scheduler System, version 1.0. No other versions or products are listed.

The CVSS score of 2.7 indicates low severity, and the vulnerability is not listed in the CISA KEV database. EPSS information is unavailable, so the likelihood of exploitation is unclear. Based on the description, it is inferred that the attack vector is through the web interface that submits data to manage_appointment.php, but this is not explicitly documented. The vulnerability could be exploited by an adversary who can send specially crafted input to the affected endpoint, enabling unauthorized data manipulation.