Is there a public PoC exploit available for CVE-2026-19231?

Yes, a public proof-of-concept exploit is available for CVE-2026-19231. Prioritise patching immediately. EPSS: 0.3%.

Doctors Appointment System CVE-2026-19231

Q: What is the CVSS score of CVE-2026-19231?

CVE-2026-19231 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-54575 MEDIUM

SQL Injection (CWE-89)

2026-08-07 VulDB

GHSA-6xff-q3mm-r426

PHP SQLi Simple Doctors Appointment System Sourcecodester

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Admin-path endpoint implies at least a low-privilege session is required; partial C/I/A impact reflects SQLi scope limited to application data.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Aug 07, 2026 - 19:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Aug 07, 2026 - 19:16 vuln.today

CVE Published

Aug 07, 2026 - 18:30 cve.org

MEDIUM 6.9

DescriptionCVE.org

A security flaw has been discovered in SourceCodester Simple Doctors Appointment System 1.0. This vulnerability affects unknown code of the file /admin/ajax.php?action=delete_appointment. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

SQL injection in SourceCodester Simple Doctors Appointment System 1.0 exposes the application's database to remote manipulation through the unsanitized 'id' parameter in the admin delete-appointment endpoint. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) indicates low-complexity remote exploitation with no authentication formally required per the reporter's assessment, though the /admin/ path implies a session context that should be independently verified. A public proof-of-concept is available on GitHub, raising practical exploitation risk despite the product's limited real-world footprint; no active exploitation (CISA KEV) has been recorded.

Technical ContextAI

The application is a PHP-based web system distributed by SourceCodester, a platform for hobbyist and student code projects. The vulnerable endpoint is /admin/ajax.php?action=delete_appointment, where the 'id' parameter is concatenated into a SQL query without sanitization or parameterization. CWE-89 (Improper Neutralization of Special Elements used in a SQL Command) is the root cause - a classic failure to use prepared statements or bound parameters in PHP database interactions (likely via mysqli or PDO). The affected CPE is cpe:2.3:a:sourcecodester:simple_doctors_appointment_system:*:*:*:*:*:*:*:*, with version 1.0 confirmed as affected per EUVD-2026-54575. The wildcard CPE version range suggests no patched version has been formally published.

RemediationAI

No vendor-released patch has been identified at time of analysis; the CPE wildcard and absence of any advisory from SourceCodester confirm no fixed version is available. The primary long-term fix is to rewrite database interactions using PDO prepared statements or mysqli parameterized queries, ensuring the 'id' parameter is bound rather than interpolated. As an immediate compensating control, restrict network access to the /admin/ directory using web server configuration (e.g., Apache .htaccess IP allowlist or nginx allow/deny directives) so only trusted management hosts can reach the endpoint - this is the most impactful short-term mitigation but requires careful allowlist maintenance. Deploying a web application firewall (WAF) with SQLi rulesets (e.g., ModSecurity CRS) can reduce exploitation success but should not be treated as a primary control. If the application is internet-facing and cannot be immediately patched or restricted, consider taking the admin interface offline until a fix is applied. References: VulDB advisory at https://vuldb.com/vuln/386995 and the public POC at https://github.com/Andyov0/cve/issues/3.