Is there a public PoC exploit available for CVE-2026-19384?

Yes, a public proof-of-concept exploit is available for CVE-2026-19384. Prioritise patching immediately. EPSS: 0.3%.

Simple Doctors Appointment System CVE-2026-19384

Q: What is the CVSS score of CVE-2026-19384?

CVE-2026-19384 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-54983 MEDIUM

SQL Injection (CWE-89)

2026-08-10 VulDB

GHSA-8rqx-j68q-cmpx

PHP SQLi Simple Doctors Appointment System Sourcecodester

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network-accessible unauthenticated endpoint needing no prerequisites; scope unchanged as injection is confined to the application's own database with limited C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Aug 10, 2026 - 03:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Aug 10, 2026 - 02:42 vuln.today

CVE Published

Aug 10, 2026 - 01:30 cve.org

MEDIUM 6.9

DescriptionCVE.org

A weakness has been identified in SourceCodester Simple Doctors Appointment System 1.0. The affected element is an unknown function of the file /admin/ajax.php?action=set_appointment. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

SQL injection in SourceCodester Simple Doctors Appointment System 1.0 exposes the /admin/ajax.php?action=set_appointment endpoint to unauthenticated remote attackers who can manipulate database queries by supplying crafted values for the id argument. The attack requires no privileges or user interaction, and a public proof-of-concept is available on GitHub, lowering the bar for exploitation significantly. No vendor-released patch has been identified at time of analysis, leaving all deployed instances of version 1.0 unmitigated.

Technical ContextAI

The affected product is a PHP-based web application identified by CPE cpe:2.3:a:sourcecodester:simple_doctors_appointment_system:*:*:*:*:*:*:*:*, distributed as a free script by SourceCodester. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): the id parameter passed to the AJAX handler /admin/ajax.php?action=set_appointment is interpolated directly into a SQL query without parameterization or escaping, allowing an attacker to alter query logic. This class of flaw typically enables data exfiltration via UNION-based or error-based injection, blind injection for inference attacks, and potentially database writes depending on the database user's privileges.

RemediationAI

No vendor-released patch has been identified at time of analysis for SourceCodester Simple Doctors Appointment System 1.0. As a primary compensating control, administrators with access to the source code should replace dynamic SQL string concatenation in the /admin/ajax.php handler with parameterized queries or prepared statements, which eliminates the injection vector entirely; this modification requires PHP development access and testing before deployment. Deploying a Web Application Firewall rule to detect and block SQL metacharacter sequences (single quotes, comment sequences, UNION keywords) in the id parameter of POST requests to /admin/ajax.php?action=set_appointment provides a lower-effort mitigation but carries a risk of false positives on legitimate numeric id values. Restricting access to the /admin/ directory via IP allowlisting at the web server or firewall layer would significantly reduce exposure if the admin interface is not required to be internet-facing. Vulnerability details are documented at https://vuldb.com/vuln/387284 and the public exploit is tracked at https://github.com/HZFW2026/cve/issues/2.