Doctor Appointment System CVE-2026-36324
MEDIUMSeverity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
3DescriptionCVE.org
SourceCodester Doctor Appointment System 1.0 is vulnerable to Cross Site Scripting (XSS) due to improper handling of user supplied input in the user registration functionality in register.php.
AnalysisAI
Stored or reflected Cross-Site Scripting in SourceCodester Doctor Appointment System 1.0 allows unauthenticated remote attackers to inject malicious JavaScript through the user registration form in register.php. When a privileged user such as an administrator views the submitted registration data, the script executes in their browser context, enabling session hijacking, credential theft, or unauthorized actions on their behalf. A public disclosure write-up is available on GitHub; no vendor patch has been identified at this time.
Technical ContextAI
The vulnerability resides in register.php, a PHP-based user registration endpoint within SourceCodester Doctor Appointment System 1.0, a MySQL-backed PHP web application. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-supplied registration fields are echoed back into HTML responses without adequate output encoding or sanitization. The changed scope (S:C) in the CVSS vector indicates the injected script executes in a browser context separate from the registration page itself - consistent with stored XSS where registration data is persisted to the database and later rendered to an administrator or other privileged user. No CPE string was provided in the intelligence data; the affected product is identified solely by the NVD description and the SourceCodester project URL.
Affected ProductsAI
SourceCodester Doctor Appointment System version 1.0 is confirmed affected. The application is a PHP/MySQL web application available from sourcecodester.com (https://www.sourcecodester.com/php/18453/doctor-appointment-system-using-php-and-mysql-source-code.html). No CPE string was included in the provided intelligence data, and no other versions are referenced. Other versions of the application may also be vulnerable, but this is unconfirmed from available data.
RemediationAI
No vendor-released patch has been identified at time of analysis. SourceCodester applications are typically community/educational projects without formal security maintenance cycles, so a vendor patch may not be forthcoming. The primary remediation is to apply proper output encoding to all user-supplied fields rendered in HTML - specifically, apply htmlspecialchars() with ENT_QUOTES in register.php before echoing any user input. Additionally, implement a Content Security Policy (CSP) header to restrict inline script execution, which would limit the impact of any remaining XSS vectors as a defense-in-depth measure. Organizations should also consider adding input validation on the server side to reject inputs containing HTML or script syntax at the registration endpoint. If this application is deployed externally, restricting access to the registration page to internal networks only would significantly reduce attack surface while a code-level fix is developed. The public disclosure write-up is available at https://github.com/adhiyaksactf/MyCVE-Disclosures/blob/main/rems-DoctorAppointmentSystem/CVE-2026-36324/README.md and should be reviewed for specific field names and payload details to guide targeted fixes.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today