CVE-2026-105470

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-105470
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-105470.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-105470
Published
2026-10-05T22:30:14Z
Modified
2026-10-08T02:49:18Z
Severity
  • 5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
girishsaraf Online-Appointment-Booking-System Doctor Search Endpoint locateus.php mysqli_query sql injection
Details

A vulnerability was identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This issue affects the function mysqli_query of the file locateus.php of the component Doctor Search Endpoint. The manipulation of the argument doctorname leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.

Database specific 
{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-74",
        "CWE-89"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-105470.json"
}
References

Affected packages

Git / github.com/girishsaraf/online-appointment-booking-system

Affected ranges

Type
GIT
Repo
https://github.com/girishsaraf/online-appointment-booking-system
Events
Introduced
f427b4757128ca253d33d0cc4e87bbb9c999a4d5
Last Affected
f427b4757128ca253d33d0cc4e87bbb9c999a4d5

Affected versions

Other
f427b4757128ca253d33d0cc4e87bbb9c999a4d5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-105470.json"