CVE-2026-37602

SourceCodester Patient Appointment Scheduler System version 1.0 contains a SQL Injection vulnerability in the /scheduler/admin/user/manage_user.php file that could allow an attacker to manipulate database queries. The vulnerability has a CVSS score of 2.7 (Low severity) and requires network access with high-level administrative privileges to exploit. The attack vector is network-based with low complexity, and the potential impact is limited to low-level confidentiality compromise with no integrity or availability risks. There is no evidence of active exploitation in the wild, the vulnerability is not tracked on the Known Exploited Vulnerabilities (KEV) list, and it maintains an inactive status on threat intelligence hot lists, indicating minimal community attention and current threat activity.