Description
A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. The affected element is the function echo of the file doctorregistration.php of the component Doctor Registration. Executing a manipulation of the argument doc_name can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been published and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-10-19
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Cross‑Site Scripting
Action: Apply Patch
AI Analysis

Impact

The flaw is an unsanitized echo of the user‑supplied "doc_name" parameter in doctorregistration.php, which allows an attacker to insert arbitrary JavaScript. This client‑side cross‑site scripting can lead to session hijacking, cookie theft, or other malicious actions executed in the victim’s browser. The vulnerability maps to CWE-79 and is also noted as a potential CWE-94 issue regarding code injection.

Affected Systems

Any deployment of the subhajitkhan online‑clinic‑management‑system that was built from code prior to the commit e9ee77a8827a1446220fa07ee693dc4d9a29a578. Because the project uses rolling releases, affected instances lack formal version numbers but are those constructed before the patch was applied.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate impact. The EPSS score is not available and the flaw is not listed in the CISA KEV catalog, indicating it has not yet been widely exploited. The attack can be launched remotely by sending a crafted "doc_name" value. The vulnerability description does not specify an authentication requirement; therefore it is assumed that any user who accesses the registration page may be affected.

Generated by OpenCVE AI on October 19, 2026 at 08:50 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the application to a version that includes the fix, such as the latest commit after e9ee77a
  • Before rendering "doc_name", apply proper HTML encoding (for example, htmlspecialchars in PHP) to eliminate injected script fragments
  • Implement a strict Content Security Policy that disallows inline scripts to add an extra layer of defense

Generated by OpenCVE AI on October 19, 2026 at 08:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 19 Oct 2026 07:45:00 +0000

Type Values Removed Values Added
Description A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. The affected element is the function echo of the file doctorregistration.php of the component Doctor Registration. Executing a manipulation of the argument doc_name can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been published and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.
Title subhajitkhan online-clinic-management-system Doctor Registration doctorregistration.php echo cross site scripting
First Time appeared Subhajitkhan
Subhajitkhan online-clinic-management-system
Weaknesses CWE-79
CWE-94
CPEs cpe:2.3:a:subhajitkhan:online-clinic-management-system:*:*:*:*:*:*:*:*
Vendors & Products Subhajitkhan
Subhajitkhan online-clinic-management-system
References
Metrics cvssV2_0

{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Subhajitkhan Online-clinic-management-system
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-19T07:30:12.696Z

Reserved: 2026-10-18T17:02:41.416Z

Link: CVE-2026-112092

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-19T08:17:03.240

Modified: 2026-10-19T08:17:03.240

Link: CVE-2026-112092

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-19T09:00:15Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')