CVE-2026-109524 Details
Description
A vulnerability was determined in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected by this issue is some unknown functionality of the file Admin/showdoctor.php of the component Admin Display Pages. This manipulation causes missing authorization. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.
A vulnerability exists in the Online Appointment Booking System by Girish Saraf, specifically in the Admin display pages, including 'showdoctor.php', 'showclinic.php', 'showmanager.php', and 'showdoctorschedule.php', all prior to commit f427b4757128ca253d33d0cc4e87bbb9c999a4d5'. The issue arises from a lack of proper authentication checks, allowing unauthenticated users to access sensitive information about doctors, clinics, and managers. This vulnerability can be exploited remotely, and although the project was notified about this issue, no response has been received.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 13, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/girishsaraf/Online-Appointment-Booking-System/ | [email protected] | ProductVendor |
| https://github.com/girishsaraf/Online-Appointment-Booking-System/issues/14 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://vuldb.com/cve/CVE-2026-109524 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/984342 | [email protected] | Permission Required |
| https://vuldb.com/vuln/417188 | [email protected] | Permission Required |
| https://vuldb.com/vuln/417188/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| girishsaraf Online-Appointment-Booking-System | f427b4757128ca253d33d0cc4e87bbb9c999a4d5 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 13, 2026 | New CVE Received | [email protected] |