CVE-2026-112139: subhajitkhan online-clinic-management-system Administrative Mutation admindocview.php sql injection
A vulnerability has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This affects an unknown function of the file admindocview.php of the component Administrative Mutation Handler. The manipulation of the argument docid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attack can be initiated remotely and requires no privileges or user interaction according to the supplied severity vector. An attacker manipulates the docid argument handled by admindocview.php.
Which deployments should be treated as potentially affected?
Deployments of subhajitkhan online-clinic-management-system at or before commit e9ee77a8827a1446220fa07ee693dc4d9a29a578 should be treated as affected. Because the project uses a rolling release model, no specific fixed or affected release versions are available.
How urgent is remediation?
Public exploit disclosure is noted, and the issue is rated high severity with network-accessible, low-complexity exploitation. The project was notified but has not responded, so the provided data does not identify an upstream fix.