HashenUdara edoc-doctor-appointment-system SQL Injection (CVE-2026-116112)
A SQL injection vulnerability exists in the admin/add-new.php file of the edoc-doctor-appointment-system via the spec parameter.
CVE search metadata
CVE search record: CVE-2026-116112. Severity: high. CVSS: 7.3. KEV: no. Product: edoc-doctor-appointment-system (<= cc258425b915d1af9e298777ccd26d160493e68d). Brief: HashenUdara edoc-doctor-appointment-system SQL Injection (CVE-2026-116112). Brief link: https://feed.craftedsignal.io/briefs/2026-10-edoc-doctor-appointment-sql-injection/
Triage facts
Revision 1- Applicability
- edoc-doctor-appointment-system (<= cc258425b915d1af9e298777ccd26d160493e68d)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Oct 26, 09:40 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
CVE-2026-116112 is a SQL injection vulnerability in HashenUdara edoc-doctor-appointment-system up to commit cc258425b915d1af9e298777ccd26d160493e68d. The flaw exists in the admin/add-new.php file, where manipulation of the 'spec' argument leads to SQL injection. The attack can be initiated remotely. Public exploit code is available. The vendor did not respond to disclosure efforts. Due to the project's rolling release model, no specific version details for affected or updated releases are available.