EUVD-2026-28644
GHSA-fmp3-3p2g-4h8r
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionNVD
Beauty Parlour Management System v1.1 was discovered to contain a SQL injection vulnerability via the aptnumber parameter in the /appointment-detail.php endpoint. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement.
AnalysisAI
SQL injection in Beauty Parlour Management System v1.1 enables unauthenticated remote attackers to extract, modify, or delete database contents through the aptnumber parameter at /appointment-detail.php endpoint. With CVSS 9.8 (critical severity) and network-accessible exploit requiring no authentication, this represents a complete compromise vector. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Identify all instances of Beauty Parlour Management System v1.1 in your environment and isolate affected systems from production networks if operationally feasible; document inventory of affected systems. Within 7 days: Implement network-level access controls restricting access to /appointment-detail.php endpoint to authorized users only via WAF rules or IP whitelisting; deploy database activity monitoring to detect malicious queries. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today