CVE-2022-36202

Critical · CVSS 9.8

Doctor's Appointment System — Insecure Direct Object Reference (IDOR) / Broken Access Control

CVSS: 9.8; nvd
EPSS: —
KEV: No
Class: other; CWE-639

Description

Doctor's Appointment System1.0 is vulnerable to Incorrect Access Control via edoc/patient/settings.php. The settings.php is affected by Broken Access Control (IDOR) via id= parameter.

Search profile — drives PoC discovery

Symbols edoc/patient/settings.phpid=settings.phppatient/settings

Keywords CVE-2022-36202Doctor's Appointment SystemIDORBroken Access Controlsettings.phpedocsourcecodesteraznullCWE-639

Versions: 1.0

Ranked PoCs (1) — best first

Heuristic ranking — not yet expert-vetted. Scored on structure + provenance, not execution.

aznull/CVEs needs review

cited in references

trickest

★ 0

Recall-favoring discovery; ranking by the Stage-4 scorer (Adam's rubric). Scanner/aggregator repos are hidden.

References

Status: enriched · ingested 2026-07-05T06:00:39.000Z · profiled 2026-07-05T12:30:39.000Z