A vulnerability was detected in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. (CVE-2026-115248)

The subhajitkhan online-clinic-management-system up to commit e9ee77a8827a1446220fa07ee693dc4d9a29a578 contains a vulnerability in the Booking Handler component, specifically in the patappointtime.php file. This vulnerability allows remote attackers with low privileges to manipulate the system's behavioral workflow. The vulnerability is remotely exploitable without user interaction and impacts integrity and availability, as reflected by a CVSS 3.1 base score of 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L). A patch commit e9ee77a8827a1446220fa07ee693dc4d9a29a578 has been identified to fix the issue. The project maintainers have been informed but have not yet responded. Public exploit code exists, though no confirmed exploitation in the wild has been reported.

The vulnerability allows remote attackers with low privileges to manipulate the behavioral workflow of the Booking Handler component, potentially impacting the integrity and availability of the system. Confidentiality is not affected. The CVSS score of 5.4 indicates a moderate impact on system operations but no direct data disclosure.

A patch identified by commit e9ee77a8827a1446220fa07ee693dc4d9a29a578 is available and should be applied to remediate this vulnerability. Since the project has not yet responded, users should prioritize implementing this patch to prevent exploitation. No other vendor advisory or official fix details are available, so monitoring for updates from the project is recommended.