https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-3817.htmlhttps://patchthecve.com/cve/CVE-2026-3817.htmlWed, 17 Jun 2026 10:44:17 +0000MEDIUM 5.3: A vulnerability was detected in SourceCodester Patients Waiting Area Queue Management System 1.0. This issue affects some unknown processing of the file /patient-search.php. The manipulation results in improper authorization. The attack can be launched remotely. The exploit is now public and may be https://patchthecve.com/cve/CVE-2026-3724.htmlhttps://patchthecve.com/cve/CVE-2026-3724.htmlWed, 17 Jun 2026 10:44:04 +0000MEDIUM 6.3: A weakness has been identified in SourceCodester Patients Waiting Area Queue Management System 1.0. This impacts an unknown function of the file /checkin.php. This manipulation of the argument patient_id causes improper authorization. It is possible to initiate the attack remotely. The exploit has bhttps://patchthecve.com/cve/CVE-2026-3171.htmlhttps://patchthecve.com/cve/CVE-2026-3171.htmlWed, 17 Jun 2026 10:43:09 +0000LOW 3.5: A flaw has been found in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /queue.php. This manipulation of the argument firstname/lastname causes cross site scripting. The attack is possible to be chttps://patchthecve.com/cve/CVE-2026-3170.htmlhttps://patchthecve.com/cve/CVE-2026-3170.htmlWed, 17 Jun 2026 10:43:09 +0000LOW 2.4: A vulnerability was detected in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. Affected is an unknown function of the file /patient-search.php. The manipulation of the argument First Name/Last Name results in cross site scripting. The attack can be executed remotely.https://patchthecve.com/cve/CVE-2026-2154.htmlhttps://patchthecve.com/cve/CVE-2026-2154.htmlWed, 17 Jun 2026 10:30:25 +0000MEDIUM 4.3: A vulnerability was identified in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. Impacted is an unknown function of the file /registration.php of the component Patient Registration Module. The manipulation of the argument First Name leads to cross site scripting. Remhttps://patchthecve.com/cve/CVE-2026-2150.htmlhttps://patchthecve.com/cve/CVE-2026-2150.htmlWed, 17 Jun 2026 10:30:25 +0000MEDIUM 4.3: A flaw has been found in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. Affected by this issue is some unknown functionality of the file /checkin.php. This manipulation of the argument patient_id causes cross site scripting. The attack can be initiated remotely. The https://patchthecve.com/cve/CVE-2026-2149.htmlhttps://patchthecve.com/cve/CVE-2026-2149.htmlWed, 17 Jun 2026 10:30:24 +0000MEDIUM 4.3: A vulnerability was detected in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /appointments.php. The manipulation of the argument patient_id results in cross site scripting. It is possible to lauhttps://patchthecve.com/cve/CVE-2026-1148.htmlhttps://patchthecve.com/cve/CVE-2026-1148.htmlWed, 17 Jun 2026 10:15:12 +0000MEDIUM 4.3: A vulnerability was determined in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. This vulnerability affects unknown code. Executing a manipulation can lead to cross-site request forgery. It is possible to launch the attack remotely.https://patchthecve.com/cve/CVE-2026-1147.htmlhttps://patchthecve.com/cve/CVE-2026-1147.htmlWed, 17 Jun 2026 10:15:12 +0000LOW 3.5: A vulnerability was found in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. This affects an unknown part of the file /php/api_patient_schedule.php. Performing a manipulation of the argument Reason results in cross site scripting. It is possible to initiate the attackhttps://patchthecve.com/cve/CVE-2026-1146.htmlhttps://patchthecve.com/cve/CVE-2026-1146.htmlWed, 17 Jun 2026 10:15:12 +0000LOW 3.5: A vulnerability has been found in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. Affected by this issue is some unknown functionality of the file /php/api_register_patient.php. Such manipulation of the argument firstName/lastName leads to cross site scripting. The athttps://patchthecve.com/cve/CVE-2025-64081.htmlhttps://patchthecve.com/cve/CVE-2025-64081.htmlSun, 18 Oct 2026 16:10:00 +0000CRITICAL 9.8: SQL injection vulnerability in /php/api_patient_schedule.php in SourceCodester Patients Waiting Area Queue Management System v1 allows attackers to execute arbitrary SQL commands via the appointmentID parameter.https://patchthecve.com/cve/CVE-2025-13248.htmlhttps://patchthecve.com/cve/CVE-2025-13248.htmlSun, 18 Oct 2026 20:10:00 +0000HIGH 7.3: A weakness has been identified in SourceCodester Patients Waiting Area Queue Management System 1.0. The impacted element is an unknown function of the file /php/api_patient_schedule.php. This manipulation of the argument appointmentID causes sql injection. The attack can be initiated remotely. The ehttps://patchthecve.com/cve/CVE-2025-13122.htmlhttps://patchthecve.com/cve/CVE-2025-13122.htmlWed, 07 Oct 2026 21:10:00 +0000HIGH 7.3: A vulnerability was detected in SourceCodester Patients Waiting Area Queue Management System 1.0. The affected element is the function getPatientAppointment of the file /php/api_patient_checkin.php. Performing manipulation of the argument appointmentID results in sql injection. It is possible to inihttps://patchthecve.com/cve/CVE-2025-63718.htmlhttps://patchthecve.com/cve/CVE-2025-63718.htmlWed, 17 Jun 2026 09:53:25 +0000MEDIUM 6.5: A SQL injection vulnerability exists in the SourceCodester PQMS (Patient Queue Management System) 1.0 in the api_patient_schedule.php endpoint. The appointmentID parameter is not properly sanitized, allowing attackers to execute arbitrary SQL commands.