Online-Appointment-Booking-System EUVD-2026-98737

No special conditions beyond the application being network-reachable - the Admin/showdoctor.php endpoint of Online-Appointment-Booking-System lacks an authorization check, so an unauthenticated remote attacker can invoke it directly (PR:N/UI:N). The primary limiting factors are scope and reach, not configuration: impact is confined to unauthorized reading of admin doctor-display data (VC:L, no write or availability impact), and the affected software is a rolling-release hobby project with no pinned vulnerable/fixed version, so exposure depends on an organization having deployed this specific codebase at all.

This is a missing-authorization flaw (CWE-862) in the Admin/showdoctor.php page of a small open-source PHP appointment-booking project. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates a network-reachable, low-complexity, unauthenticated issue, but the impact is deliberately scoped as VC:L/VI:N/VA:N - only limited confidentiality (unauthorized read of data that should sit behind the admin boundary), with no integrity or availability impact, which is why the base score is only 6.9 (Medium). No EPSS score, SSVC decision, or CISA KEV entry was provided in the input, so widespread or automated exploitation cannot be asserted. A public proof-of-concept exists (reflected in the E:P exploit-maturity metric and the referenced GitHub issue), so the barrier to trying the exploit is low, but the signals together point to a LOW real-world priority rather than an urgent threat: the affected software is an individual's hobby/reference GitHub project with negligible production footprint, the data exposure is limited, and there is no evidence of active exploitation. EPSS is absent (not low), so no probability claim should be made; the dominant limiting factor is prevalence, not exploit difficulty.

A remote, unauthenticated attacker directly requests Admin/showdoctor.php and, because the page performs no authorization check, receives the doctor listing/details that should be restricted to administrators. A public proof-of-concept is available (linked from the project's GitHub issue tracker), so the request can be reproduced with a standard browser or HTTP client with no special tooling.