Online Appointment Booking System 1.0: Unauthenticated SQL Injection (CVE-2025-7753)
A public proof-of-concept exploit exists for an unauthenticated, time-based SQL injection vulnerability in the username parameter of the /admin/adddoctor.php endpoint in Online Appointment Booking System 1.0.
CVE search metadata
CVE search record: CVE-2025-7753. Severity: high. CVSS: 7.3. EPSS: 0.49%. KEV: no. Product: Online Appointment Booking System 1.0. Brief: Online Appointment Booking System 1.0: Unauthenticated SQL Injection (CVE-2025-7753). Brief link: https://feed.craftedsignal.io/briefs/2026-11-cve-2025-7753/
Triage facts
Revision 1- Applicability
- Online Appointment Booking System 1.0
- Evidence
- Not observedLow confidence
- Severity
- High
- Sources
- 2 public sources
- Freshness
- Revision 1Nov 9, 13:35 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- C3Roughly even chance
An unauthenticated, time-based SQL injection vulnerability (CVE-2025-7753) has been identified in version 1.0 of the Online Appointment Booking System. The vulnerability resides in the 'username' parameter of the '/admin/adddoctor.php' file. Public proof-of-concept exploit code is available, which utilizes libcurl on Linux systems to execute SQL queries. The vulnerability is rated with a CVSS score of 9.8 (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).