CVE-2025-13122
A vulnerability was detected in SourceCodester Patients Waiting Area Queue Management System 1.0. The affected element is the function getPatientAppointment of the file /php/api_patient_checkin.php. Performing manipulation of the argument appointmentID results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.
- Score
- CVSS 3.1 9.8 Critical
- Status
- Analyzed - cna@vuldb.com
- Published
- 2025-11-13
- Last modified
- 2026-10-07
- Weaknesses
- CWE-74, CWE-89
Affected products
- Patients Waiting Area Queue Management System (Pamzey)
- Patients Waiting Area Queue Management System (Sourcecodester)
References
- https://vuldb.com/?id.332350
- https://vuldb.com/?ctiid.332350
- https://vuldb.com/?submit.683789
- https://www.sourcecodester.com/
