hashenudara 関連製品全体の CVE とセキュリティ脆弱性情報を集約し、CVSS、EPSS、公開日、脆弱性情報データを掲載しています。
一般的な弱点パターンには vendor risk sql injection、vendor risk cross-site scripting、vendor risk csrf, and vendor risk input validation があり、vendor surface production workloads の利用場面で vendor impact data exposure and vendor impact session compromise などのリスクが生じる可能性があります。
掲載データは公開脆弱性情報とセキュリティ公告に基づき、過去の暴露面と修補優先度の評価に利用できます。
| CVE | 概要 | ソース | CVSS 最大値 | EPSS（%） | 公開 | 更新 |
|---|---|---|---|---|---|---|
| CVE-2025-66918 | edoc-doctor-appointment-system v1.0.1 is vulnerable to Cross Site Scripting (XSS) in admin/add-session.php via the "title" parameter. | [email protected] | 8.8 | 0.47% | 2025-12-11 | 2026-06-17 |
| CVE-2025-65358 | Edoc-doctor-appointment-system v1.0.1 was discovered to contain SQl injection vulnerability via the 'docid' parameter at /admin/appointment.php. | [email protected] | 9.8 | 0.36% | 2025-12-02 | 2026-06-17 |
| CVE-2022-36548 | Edoc-doctor-appointment-system v1.0.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability at /patient/settings.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name text field. | [email protected] | 5.4 | 0.48% | 2022-08-26 | 2026-06-17 |
| CVE-2022-36547 | Edoc-doctor-appointment-system v1.0.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability at /patient/index.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Search field. | [email protected] | 6.1 | 0.52% | 2022-08-26 | 2026-06-17 |
| CVE-2022-36546 | Edoc-doctor-appointment-system v1.0.1 was discovered to contain a Cross-Site Request Forgery (CSRF) via /patient/settings.php. | [email protected] | 8.8 | 0.41% | 2022-08-26 | 2026-06-17 |
| CVE-2022-36545 | Edoc-doctor-appointment-system v1.0.1 was discovered to contain a SQL injection vulnerability via the id parameter at /patient/settings.php. | [email protected] | 9.8 | 0.95% | 2022-08-26 | 2026-06-17 |
| CVE-2022-36544 | Edoc-doctor-appointment-system v1.0.1 was discovered to contain a SQL injection vulnerability via the id parameter at /patient/booking.php. | [email protected] | 9.8 | 0.95% | 2022-08-26 | 2026-06-17 |
| CVE-2022-36543 | Edoc-doctor-appointment-system v1.0.1 was discovered to contain a SQL injection vulnerability via the id parameter at /patient/doctors.php. | [email protected] | 9.8 | 0.95% | 2022-08-26 | 2026-06-17 |
| CVE-2022-36542 | An access control issue in the component /ip/admin/ of Edoc-doctor-appointment-system v1.0.1 allows attackers to arbitrarily edit, read, and delete Administrator data. | [email protected] | 6.5 | 0.59% | 2022-08-26 | 2026-06-17 |