Skip to main content

Doctor Appointment System CVE-2026-36324

MEDIUM
Cross-site Scripting (XSS) (CWE-79)
2026-05-29 cve@mitre.org
6.1
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
6.1 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

3
Analysis Generated
Jun 01, 2026 - 17:26 vuln.today
CVSS changed
Jun 01, 2026 - 17:22 NVD
6.1 (MEDIUM)
CVE Published
May 29, 2026 - 16:16 nvd
UNKNOWN (no severity yet)

DescriptionCVE.org

SourceCodester Doctor Appointment System 1.0 is vulnerable to Cross Site Scripting (XSS) due to improper handling of user supplied input in the user registration functionality in register.php.

AnalysisAI

Stored or reflected Cross-Site Scripting in SourceCodester Doctor Appointment System 1.0 allows unauthenticated remote attackers to inject malicious JavaScript through the user registration form in register.php. When a privileged user such as an administrator views the submitted registration data, the script executes in their browser context, enabling session hijacking, credential theft, or unauthorized actions on their behalf. A public disclosure write-up is available on GitHub; no vendor patch has been identified at this time.

Technical ContextAI

The vulnerability resides in register.php, a PHP-based user registration endpoint within SourceCodester Doctor Appointment System 1.0, a MySQL-backed PHP web application. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-supplied registration fields are echoed back into HTML responses without adequate output encoding or sanitization. The changed scope (S:C) in the CVSS vector indicates the injected script executes in a browser context separate from the registration page itself - consistent with stored XSS where registration data is persisted to the database and later rendered to an administrator or other privileged user. No CPE string was provided in the intelligence data; the affected product is identified solely by the NVD description and the SourceCodester project URL.

Affected ProductsAI

SourceCodester Doctor Appointment System version 1.0 is confirmed affected. The application is a PHP/MySQL web application available from sourcecodester.com (https://www.sourcecodester.com/php/18453/doctor-appointment-system-using-php-and-mysql-source-code.html). No CPE string was included in the provided intelligence data, and no other versions are referenced. Other versions of the application may also be vulnerable, but this is unconfirmed from available data.

RemediationAI

No vendor-released patch has been identified at time of analysis. SourceCodester applications are typically community/educational projects without formal security maintenance cycles, so a vendor patch may not be forthcoming. The primary remediation is to apply proper output encoding to all user-supplied fields rendered in HTML - specifically, apply htmlspecialchars() with ENT_QUOTES in register.php before echoing any user input. Additionally, implement a Content Security Policy (CSP) header to restrict inline script execution, which would limit the impact of any remaining XSS vectors as a defense-in-depth measure. Organizations should also consider adding input validation on the server side to reject inputs containing HTML or script syntax at the registration endpoint. If this application is deployed externally, restricting access to the registration page to internal networks only would significantly reduce attack surface while a code-level fix is developed. The public disclosure write-up is available at https://github.com/adhiyaksactf/MyCVE-Disclosures/blob/main/rems-DoctorAppointmentSystem/CVE-2026-36324/README.md and should be reviewed for specific field names and payload details to guide targeted fixes.

More in PHP

View all
CVE-2012-1823 CRITICAL POC
9.8 May 11

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not

CVE-2016-1555 CRITICAL POC
9.8 Apr 21

(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear

CVE-2024-11680 CRITICAL POC
9.8 Nov 26

ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C

CVE-2025-49113 CRITICAL POC
9.9 Jun 02

Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au

CVE-2017-9841 CRITICAL POC
9.8 Jun 27

Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c

CVE-2025-0108 HIGH POC
8.8 Feb 12

Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers

CVE-2021-25298 HIGH POC
8.8 Feb 15

Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re

CVE-2021-25296 HIGH POC
8.8 Feb 15

Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re

CVE-2013-4983 CRITICAL POC
10.0 Sep 10

The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows

CVE-2023-6553 CRITICAL POC
9.8 Dec 15

The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1

CVE-2024-46506 CRITICAL POC
10.0 May 13

NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro

CVE-2024-8353 CRITICAL POC
9.8 Sep 28

The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all

Share

CVE-2026-36324 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy