CVE-2026-19839
Received Received - Intake

Unrestricted File Upload in Simple Doctors Appointment System

Publication date: 2026-08-14

Last updated on: 2026-08-14

Assigner: VulDB

Description
A vulnerability was detected in SourceCodester Simple Doctors Appointment System 1.0. This issue affects the function save_doctor of the file /save_file.php. The manipulation results in unrestricted upload. The attack can be executed remotely. The exploit is now public and may be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-14
Last Modified
2026-08-14
Generated
2026-08-14
AI Q&A
2026-08-14
EPSS Evaluated
N/A
NVD
CVE-2026-19839
EUVD
EUVD-2026-58713

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
sourcecodester simple_doctors_appointment_system 1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an unrestricted file upload flaw in Simple Doctors Appointment System 1.0. It affects the save_doctor function in save_file.php, allowing attackers to upload any file type without restrictions. Since the system does not properly validate or sanitize uploaded files, malicious files could be executed, leading to potential remote code execution or other attacks.

Detection Guidance

To detect this vulnerability, check for unauthorized file uploads in the /doctors/admin/ajax.php file with the action=save_doctor parameter. Monitor for unexpected file types or scripts in upload directories. Use tools like Wireshark to inspect HTTP POST requests to this endpoint for suspicious payloads.

Impact Analysis

This vulnerability can allow attackers to upload malicious files to the server, potentially leading to remote code execution. This could result in unauthorized access to sensitive data, system compromise, or disruption of services. Attackers might also deface the website or use the system to launch further attacks.

Compliance Impact

This vulnerability could lead to breaches of GDPR or HIPAA by exposing sensitive patient or user data. Unauthorized file uploads may result in data leaks, violating confidentiality requirements. Compliance with these regulations could be compromised due to potential unauthorized access or data loss.

Mitigation Strategies

Immediately restrict file uploads to only allowed types (e.g., images). Validate file extensions and MIME types server-side. Disable execution permissions for uploaded files. Update or patch the Simple Doctors Appointment System to the latest version if available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19839. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart