CVE-2026-115249: subhajitkhan online-clinic-management-system Appointment Booking patappointtime.php input validation
A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. Impacted is an unknown function of the file patappointtime.php of the component Appointment Booking. This manipulation of the argument day/time/appdate causes improper input validation. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attack can be initiated remotely, but the vector indicates that the attacker needs low-privileged access and user interaction is required. Exploitation involves manipulating the day, time, or appdate argument in the Appointment Booking component.
How likely is exploitation?
A public exploit has been published and may be used. The issue is rated medium severity, with low attack complexity.
Which deployments should be investigated?
Investigate deployments of subhajitkhan online-clinic-management-system at revisions up to e9ee77a8827a1446220fa07ee693dc4d9a29a578, particularly where the Appointment Booking functionality and patappointtime.php are exposed.
Is a vendor fix available?
The project was informed through an issue report but had not responded at the time of the report. No fixed version or vendor remediation is provided in the available data.