CVE-2026-90701: subhajitkhan online-clinic-management-system listdoctor.php sql injection
A vulnerability was detected in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. The affected element is an unknown function of the file listdoctor.php. Performing a manipulation of the argument searchtext results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attack can be initiated remotely and does not require privileges or user interaction. Exploitation involves manipulating the searchtext argument handled by listdoctor.php.
How likely is exploitation in practice?
A public exploit is available and may be used. The reported assessment rates exploit maturity as proof-of-concept.
How can I identify affected deployments or a fixed release?
Deployments using revisions up to commit e9ee77a8827a1446220fa07ee693dc4d9a29a578 are reported as affected. Because the project uses a rolling release model, no specific affected or updated release versions are available, and the project had not responded to the report.