Vulnerability · Published Oct 22, 2026 · Assigned by VulDB
CVE-2026-115248subhajitkhan online-clinic-management-system Booking patappointtime.php behavioral workflow
Medium 5.4
In plain English
A medium-severity security flaw in online-clinic-management-system from subhajitkhan. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).
Official description
A vulnerability was detected in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This issue affects some unknown processing of the file patappointtime.php of the component Booking Handler. The manipulation results in enforcement of behavioral workflow. It is possible to launch the attack remotely. The exploit is now public and may be used. The patch is identified as e9ee77a8827a1446220fa07ee693dc4d9a29a578. It is advisable to implement a patch to correct this issue. The project was informed of the problem early through an issue report but has not responded yet.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| subhajitkhan | online-clinic-management-system | e9ee77a8827a1446220fa07ee693dc4d9a29a578 |
Weakness: CWE-841, CWE-840 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C
References
- VDB-425221 | subhajitkhan online-clinic-management-system Booking patappointtime.php behavioral workflow vdb-entry
- VDB-425221 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
- CVE-2026-115248 | CVE Analysis and Report third-party-advisory
- Submit #1021709 | subhajitkhan online-clinic-management-system e9ee77a8827a1446220fa07ee693dc4d9a29a578 Client-Side Enforcement of Server-Side Security third-party-advisory
- https://github.com/subhajitkhan/online-clinic-management-system/issues/10 exploit, issue-tracking
- https://github.com/subhajitkhan/online-clinic-management-system/ product