CVE-2026-39620 is a Cross-Site Request Forgery (CSRF) vulnerability in priyanshumittal Appointment versions 3.5.5 and earlier that permits attackers to upload web shells to affected servers. This vulnerability carries a critical CVSS score of 9.6, indicating severe risk potential with network-based attack vectors requiring no special privileges but user interaction. The attack can result in complete system compromise including confidentiality, integrity, and availability breaches across the affected environment. Currently, there is no evidence of active exploitation in the wild, with no known exploit code publicly available and the vulnerability remaining inactive on threat tracking lists. The relatively low EPSS score of 0.000190 suggests minimal real-world exploitation activity despite the high theoretical severity rating.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| Priyanshumittal | Appointment | >= 0, <= 3.5.5CNA affecteddefault unaffected |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.8 Bluesky, 0.5 Mastodon, and 1.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.
Remediation records are not available for this CVE.