The SourceCodester Patient Appointment Scheduler System version 1.0 has a vulnerability that permits SQL injection through the /scheduler/admin/user/manage_user.php endpoint. An attacker could manipulate input parameters to execute arbitrary SQL commands, potentially allowing read, modification, or deletion of sensitive data stored in the system’s database.

This flaw affects the Patient Appointment Scheduler System released by SourceCodester, specifically version 1.0. No other product or vendor variants are listed.

The CVSS score of 2.7 indicates low severity, and no exploit probability score is available. The vulnerability is not present in the CISA KEV catalog. Attackers who can reach the exposed admin endpoint—likely over the network—could exploit the injection to access or alter database contents. No publicly disclosed exploits have been reported.