CVE-2026-85403

5.5 mediumEPSS 0.4%

A flaw has been found in code-projects Doctor Appointment System 1.0. This issue affects some unknown processing of the file /contactus.php. This manipulation of the argument firstname causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and may be used.

Severity

CVSS 4.0

5.5 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

CVSS 3.1

7.3 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 37% of CVEs (scores of 2026-10-31)
CWEs: CWE-74, CWE-89
Published: 2026-09-04
Modified: 2026-09-04
Record from: the NVD, synced 2026-10-19

References

https://code-projects.org/
https://github.com/lccc-t/CVE/issues/6
https://vuldb.com/cve/CVE-2026-85403
https://vuldb.com/submit/894881
https://vuldb.com/vuln/398546

Check your stack JSON