SourceCodester Patient Appointment Scheduler System v1.0 contains a SQL Injection vulnerability in the file /scheduler/admin/appointments/manage_appointment.php. An attacker who can send crafted requests to this endpoint may control the SQL queries executed by the application, allowing unauthorized access to appointment and user data, and potentially modifying or deleting records. The core weakness is unchecked user input in database queries, which can lead to leakage or alteration of sensitive medical scheduling information.

The affected product is the Patient Appointment Scheduler System version 1.0 developed by SourceCodester. No other vendors or versions are mentioned, so this issue is confined to the specific version listed.

The vulnerability is exploitable over the network via malicious input supplied through the web interface; the attacker does not need privileged local access. While no EPSS score is available and the issue is not listed in CISA’s KEV catalog, the lack of mitigation means that attackers can leverage it relatively easily. The high impact on data confidentiality and integrity, combined with the ease of exploitation, places this vulnerability in a high‑risk category.