CVE-2021-27316

CVE-2021-27316 is a high-severity blind SQL injection vulnerability affecting version 1.0 of the Doctor Appointment System. An unauthenticated attacker can exploit this flaw by injecting malicious SQL queries into the 'lastname' parameter of the contactus.php page. With a CVSS score of 7.5, this vulnerability allows for high confidentiality impact without requiring user interaction or complex attack methods. While not listed in CISA's KEV catalog, a Nuclei template exists for detection, and its EPSS score indicates a high probability of exploitation. There is currently no evidence of active exploitation, Metasploit modules, or significant community discussion.