Vulnerability · Published Mar 31, 2026 · Assigned by VulDB

CVE-2026-5181SourceCodester Simple Doctors Appointment System ajax.php unrestricted upload

Medium 6.3

In plain English

A medium-severity unrestricted file upload in Simple Doctors Appointment System from SourceCodester. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.2%top 88.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability has been found in SourceCodester Simple Doctors Appointment System up to 1.0. This issue affects some unknown processing of the file /doctors_appointment/admin/ajax.php?action=save_category. Such manipulation of the argument img leads to unrestricted upload. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.

Affected products (as reported)

Vendor	Product	Versions
SourceCodester	Simple Doctors Appointment System	1.0

Weakness: CWE-434, CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-354249 | SourceCodester Simple Doctors Appointment System ajax.php unrestricted upload vdb-entry, technical-description
VDB-354249 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #780375 | SourceCodester Simple Doctor's Appointment System 1.0 Unrestricted Upload third-party-advisory
https://github.com/dyh1213-wq/cve/issues/5 exploit, issue-tracking
https://www.sourcecodester.com/ product