A security vulnerability has been detected in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. (CVE-2026-115247)

The subhajitkhan online-clinic-management-system contains a security vulnerability in the patientregistration.php file where manipulation of the pat_pswd/doc_pswd argument leads to missing encryption of sensitive data. This vulnerability can be exploited remotely. The project was notified early via an issue report but has not issued a fix or response. The vulnerability has been publicly disclosed and may be exploited, though no known exploits in the wild have been reported.

Sensitive data such as patient or doctor passwords may be transmitted or stored without encryption, potentially exposing this information to unauthorized parties. The confidentiality of this data is impacted, but integrity and availability are not affected. The vulnerability can be exploited remotely, increasing the risk of data exposure.

No official fix or patch is currently available, and the project has not responded to the issue report. Users should monitor the project for updates or consider implementing their own encryption measures for sensitive data fields as a temporary mitigation. Patch status is not yet confirmed — check the vendor advisory or project repository for current remediation guidance.