CVE-2020-29168

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

SQL Injection vulnerability in Projectworlds Online Doctor Appointment Booking System, allows attackers to gain sensitive information via the q parameter to the getuser.php endpoint.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://projectworlds.in/free-projects/php-projects/online-doctor-appointment-booking-system-php-and-mysql/%2C
https://projectworlds.in/wp-content/uploads/2020/05/PHP-Doctor-Appointment-System.zipProduct
https://www.exploit-db.com/exploits/49059Exploit, Third Party Advisory, VDB Entry
https://projectworlds.in/free-projects/php-projects/online-doctor-appointment-booking-system-php-and-mysql/%2C
https://projectworlds.in/wp-content/uploads/2020/05/PHP-Doctor-Appointment-System.zipProduct
https://www.exploit-db.com/exploits/49059Exploit, Third Party Advisory, VDB Entry

Timeline

Published: Feb 17, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-291716.1Cross-site scripting (XSS) vulnerability in admin/wp-security-blacklist-menu.php in the Tips and Tricks HQ All In One WP Security & Firewall CVE-2020-291726.1A cross-site scripting (XSS) vulnerability in the LiteSpeed Cache plugin before 3.6.1 for WordPress can be exploited via the Server IP setti CVE-2020-291767.8An arbitrary file upload vulnerability in Z-BlogPHP v1.6.1.2100 allows attackers to execute arbitrary code via a crafted JPG file.CVE-2020-291779.1Z-BlogPHP v1.6.1.2100 was discovered to contain an arbitrary file deletion vulnerability via \app_del.php.CVE-2020-291898.1Incorrect Access Control vulnerability in TerraMaster TOS <= 4.2.06 allows remote authenticated attackers to bypass read-only restriction an CVE-2020-291936.8Panasonic Security System WV-S2231L 4.25 has an insecure hard-coded password of lkjhgfdsa (which is just the asdf keyboard row in reverse or CVE-2020-291947.5Panasonic Security System WV-S2231L 4.25 allows a denial of service of the admin control panel (which will require a physical reset to resto CVE-2020-29206.1Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security). Supported versions that are affected are 9.3.3, CVE-2020-292039.8struct2json before 2020-11-18 is affected by a Buffer Overflow because strcpy is used for S2J_STRUCT_GET_string_ELEMENT.CVE-2020-292046.1XXL-JOB 2.2.0 allows Stored XSS (in Add User) to bypass the 20-character limit via xxl-job-admin/src/main/java/com/xxl/job/admin/controller/CVE-2020-292056.1XSS in signup form in Project Worlds Online Examination System 1.0 allows remote attacker to inject arbitrary code via the name field CVE-2020-29214.4Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Group Replication Plugin). Supported versions that are affecte