CVE-2026-112092: subhajitkhan online-clinic-management-system Doctor Registration doctorregistration.php echo cross site scripting
A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. The affected element is the function echo of the file doctorregistration.php of the component Doctor Registration. Executing a manipulation of the argument docname can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been published and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
An attacker can remotely manipulate the doc_name argument submitted to doctorregistration.php. Exploitation requires a victim to interact with the resulting malicious content, consistent with the UI:R vector.
Is there a known fixed version?
No version-specific fix information is available because the project uses rolling releases. The affected code is reported through commit e9ee77a8827a1446220fa07ee693dc4d9a29a578, and the project had not responded to the report at the time of publication.
How can I determine whether my deployment is affected?
Review doctorregistration.php in the Doctor Registration component and determine whether the doc_name value is echoed into an HTTP response without appropriate output encoding. Deployments containing the affected code lineage up to the identified commit should be treated as potentially affected.
What can be done if an update is not available?
Apply context-appropriate output encoding before rendering doc_name and validate or restrict the value accepted for that parameter. Because public exploit material exists, prioritize limiting access to the registration endpoint until the vulnerable output handling is corrected.