CVE-2026-112092: Cross Site Scripting in subhajitkhan online-clinic-management-system

A cross-site scripting vulnerability (CVE-2026-112092) affects the subhajitkhan online-clinic-management-system up to commit e9ee77a8827a1446220fa07ee693dc4d9a29a578. The vulnerability is in the echo function of doctorregistration.php in the Doctor Registration component, where manipulation of the doc_name argument can lead to XSS. The attack can be launched remotely without authentication. The project follows rolling releases, so no fixed version is specified. The vulnerability has been publicly disclosed and an exploit is available, but the vendor has not responded or issued a patch.

Successful exploitation of this vulnerability allows remote attackers to execute arbitrary scripts in the context of the affected application, potentially leading to session hijacking, defacement, or other malicious actions that rely on script execution in the victim's browser. The CVSS 4.0 score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, user interaction needed, and limited impact on confidentiality and integrity.

No official fix or patch is currently available as the vendor has not responded to the issue report. Users should monitor the vendor's communications for updates. Until a patch is released, consider implementing web application firewall (WAF) rules to detect and block malicious input targeting the doc_name parameter. Avoid using untrusted input directly in output without proper sanitization or encoding.