Vulnerabilidades

Resumen — últimos 7 días

Vulnerabilidades nuevas2970▼ 106 respecto a la semana anterior

Críticas / altas1447▲ 86 respecto a la semana anterior

Nueva explotación activa (KEV)4▼ 5 respecto a la semana anterior

Sin puntuar (sin CVSS)350▼ 160 respecto a la semana anterior

10 resultados, ordenados por fecha de publicación (más recientes primero)

CVE	Estado	Severidad	EPSS	Explotación activa	Tecnologías afectadas	Publicada ▼	Modificada	Descripción
CVE-2025-66918	Analizada	Alta (8.8)	0.56%	—	Hashenudara Edoc-doctor-appointment-system	11/12/2025	17/6/2026	edoc-doctor-appointment-system v1.0.1 is vulnerable to Cross Site Scripting (XSS) in admin/add-session.php via the "title" parameter.
CVE-2025-65358	Analizada	Crítica (9.8)	0.41%	—	Hashenudara Edoc-doctor-appointment-system	2/12/2025	17/6/2026	Edoc-doctor-appointment-system v1.0.1 was discovered to contain SQl injection vulnerability via the 'docid' parameter at /admin/appointment.php.
CVE-2022-38946	Analizada	Crítica (9.8)	0.79%	—	Divscorp Doctor-appointment	9/12/2024	17/6/2026	Arbitrary File Upload vulnerability in Doctor-Appointment version 1.0 in /Frontend/signup_com.php, allows attackers to execute arbitrary code.
CVE-2022-36548	Analizada	Media (5.4)	0.61%	—	Hashenudara Edoc-doctor-appointment-system	26/8/2022	17/6/2026	Edoc-doctor-appointment-system v1.0.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability at /patient/settings.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name text field.
CVE-2022-36547	Analizada	Media (6.1)	0.66%	—	Hashenudara Edoc-doctor-appointment-system	26/8/2022	17/6/2026	Edoc-doctor-appointment-system v1.0.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability at /patient/index.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Search field.
CVE-2022-36546	Analizada	Alta (8.8)	0.50%	—	Hashenudara Edoc-doctor-appointment-system	26/8/2022	17/6/2026	Edoc-doctor-appointment-system v1.0.1 was discovered to contain a Cross-Site Request Forgery (CSRF) via /patient/settings.php.
CVE-2022-36545	Analizada	Crítica (9.8)	1.2%	—	Hashenudara Edoc-doctor-appointment-system	26/8/2022	17/6/2026	Edoc-doctor-appointment-system v1.0.1 was discovered to contain a SQL injection vulnerability via the id parameter at /patient/settings.php.
CVE-2022-36544	Analizada	Crítica (9.8)	1.2%	—	Hashenudara Edoc-doctor-appointment-system	26/8/2022	17/6/2026	Edoc-doctor-appointment-system v1.0.1 was discovered to contain a SQL injection vulnerability via the id parameter at /patient/booking.php.
CVE-2022-36543	Analizada	Crítica (9.8)	1.2%	—	Hashenudara Edoc-doctor-appointment-system	26/8/2022	17/6/2026	Edoc-doctor-appointment-system v1.0.1 was discovered to contain a SQL injection vulnerability via the id parameter at /patient/doctors.php.
CVE-2022-36542	Analizada	Media (6.5)	0.75%	—	Hashenudara Edoc-doctor-appointment-system	26/8/2022	17/6/2026	An access control issue in the component /ip/admin/ of Edoc-doctor-appointment-system v1.0.1 allows attackers to arbitrarily edit, read, and delete Administrator data.