A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. (CVE-2026-115249)

The subhajitkhan online-clinic-management-system up to commit e9ee77a8827a1446220fa07ee693dc4d9a29a578 contains an input validation flaw in an unknown function within patappointtime.php related to Appointment Booking. Manipulation of the day/time/appdate parameters can be performed remotely, potentially leading to limited impact such as integrity or availability issues. The vulnerability is tracked as CVE-2026-115249 with a CVSS 3.1 base score of 4.6 (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L). The project has been informed but has not issued a fix or response. Exploit code is publicly available.

The vulnerability allows remote attackers with low privileges and requiring user interaction to manipulate appointment booking parameters, causing improper input validation. This may result in limited integrity and availability impacts, but no confidentiality loss. The CVSS score reflects a low severity risk.

No official fix or patch is currently available as the vendor has not responded. Users should monitor the project for updates and consider restricting access or applying input validation controls on the affected component if possible. Patch status is not yet confirmed — check the vendor advisory or project repository for current remediation guidance.