The vulnerability is an input validation flaw in the Appointment Booking module's patappointtime.php script, where the day, time, and appdate arguments are not properly validated. This flaw allows an attacker to send crafted requests that could manipulate the appointment scheduling logic, potentially revealing or altering appointment data. The weakness corresponds to CWE-20, which typically permits unauthorized actions or data exposure.

The affected product is the online-clinic-management-system released by subhajitkhan. All versions up to and including the code commit e9ee77a8827a1446220fa07ee693dc4d9a29a578 are vulnerable. No other vendors or products are listed as affected.

The CVSS score is 5.1, indicating a moderate impact. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The exploit is published and can be initiated remotely, so the risk is present for any publicly exposed instance of the system. While the severity is moderate, the lack of response from the project and the proved exploitability increase the urgency of remediation.