CVE-2026-90805: subhajitkhan online-clinic-management-system doctorlogin.php sql injection
A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This affects an unknown part of the file doctorlogin.php. Executing a manipulation of the argument docmail/docpswd can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attack can be executed remotely and requires no privileges or user interaction. Exploitation involves manipulating the doc_mail or doc_pswd arguments handled by doctorlogin.php.
How likely is exploitation in the near term?
An exploit has been published and may be used. The issue is rated high severity, with low attack complexity and network attack access.
How can I determine whether my deployment is affected?
Deployments containing the affected doctorlogin.php login handling and code up to commit e9ee77a8827a1446220fa07ee693dc4d9a29a578 should be treated as affected. Because the project uses a rolling release, affected and fixed version numbers are not available.
Is a vendor fix available?
The project was notified through an issue report but had not responded at the time of the vulnerability report. No fixed release or updated version is identified in the available information.