CVE-2026-90858

A vulnerability was found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578 in an unknown function of patientregistration.php. Manipulating the pat_name argument leads to cross-site scripting. The attack can be launched remotely, the exploit has been disclosed publicly and may be used; the project has not responded.

A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. Impacted is an unknown function of the file patappointtime.php of the component Appointment Booking. This manipulation of the argument day/time/appdate causes improper input validation. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability was detected in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This issue affects some unknown processing of the file patappointtime.php of the component Booking Handler. The manipulation results in enforcement of behavioral workflow. It is possible to launch the attack remotely. The exploit is now public and may be used. The patch is identified as e9ee77a8827a1446220fa07ee693dc4d9a29a578. It is advisable to implement a patch to correct this issue. The project was informed of the problem early through an issue report but has not responded yet.

A security vulnerability has been detected in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This vulnerability affects unknown code of the file patientregistration.php. The manipulation of the argument pat_pswd/doc_pswd leads to missing encryption of sensitive data. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

In subhajitkhan online-clinic-management-system up to commit e9ee77a, patdocmsg.php is vulnerable to cross-site scripting via manipulation of the Query argument. The attack can be performed remotely and a public exploit is available.

A cross-site scripting (XSS) vulnerability has been found in the online-clinic-management-system (subhajitkhan) in feedback.php. Manipulation of the msg argument allows remote injection of malicious script. The exploit has been publicly disclosed and may be used.

A cross-site scripting (XSS) vulnerability has been found in the Doctor Registration component of online-clinic-management-system (subhajitkhan) in doctorregistration.php. Manipulation of the doc_name argument in the echo function allows remote execution of malicious script. The exploit has been published and may be used.

A flaw was found in online-clinic-management-system in doctorlogin.php, where manipulation of the doc_mail/doc_pswd arguments leads to SQL injection. The attack can be executed remotely and a public exploit may already be in use. The project was notified but has not responded.

A vulnerability was detected in subhajitkhan online-clinic-management-system in the file listdoctor.php. Manipulation of the searchtext argument leads to SQL injection. The attack may be initiated remotely and the exploit is publicly available.

SQL injection vulnerability in Online Clinic Management System 1.0, in success/login.php, in the Admin Login component. Manipulation of the Username argument leads to SQL injection. Remote exploitation is possible.