The vulnerability allows manipulation of the pat_pswd/doc_pswd arguments in patientregistration.php, resulting in those sensitive values being stored without encryption. Consequently, an attacker can obtain user passwords or document passwords in plain text, leading to potential abuse of patient data. The weakness stems from missing encryption logic, which is a confidentiality issue (CWE-310, CWE-311).

The affected product is the online‑clinic‑management‑system developed by subhajitkhan. Code up to commit e9ee77a8827a1446220fa07ee693dc4d9a29a578 contains the vulnerability. No specific version numbers are listed in the CNA data, so the vulnerability applies to any build derived from that commit that still includes patientregistration.php with unencrypted storage.

The CVSS score is 5.3, indicating a moderate impact. EPSS data is unavailable, but the vulnerability has been publicly disclosed and can be triggered remotely by supplying crafted arguments. It is not listed in the CISA KEV catalog. Attackers can steal credentials or sensitive patient data if they gain access to the registration endpoint. Because of the moderate CVSS and lack of a public exploit yet, the risk is considered moderate to high depending on exposure.