Andyqaq

A vulnerability was identified in SourceCodester Photo Share Website 1.0. This affects an unknown part of the file /social/ajax.php?action=save upload of the component Comment Input Box. The manipulation of the argument content leads to cross site scripting. The attack may be initiated remotely. The exploit is publicly available and might be used.

A security flaw has been discovered in SourceCodester Simple Doctors Appointment System 1.0. This vulnerability affects unknown code of the file /admin/ajax.php?action=delete appointment. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.

**Name of the Vulnerable Software and Affected Versions** itsourcecode Hospital Management System version 1.0 **Description** A remote SQL injection is possible due to improper handling of the `patientid` argument within an unknown function of the '/treatmentdetail.php' endpoint. SQL injection is a technique where an attacker inserts malicious SQL code into a query, allowing them to manipulate the database. **Recommendations** As a temporary workaround, avoid using the `patientid` argument in the '/treatmentdetail.php' endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.