CVE-2026-112093: Cross Site Scripting in subhajitkhan online-clinic-management-system

This vulnerability in the subhajitkhan online-clinic-management-system involves a cross-site scripting issue in the feedback.php file. An attacker can manipulate the 'msg' parameter to inject malicious scripts, potentially impacting users who interact with the affected functionality. The product uses continuous delivery with rolling releases, so no explicit version information is available. The vendor has been notified but has not yet responded or issued a fix. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low attack complexity, no privileges required, and user interaction needed.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the victim's browser when interacting with the vulnerable feedback functionality. This can lead to session hijacking, defacement, or other client-side impacts. The vulnerability is remotely exploitable without authentication but requires user interaction. There is no indication of server-side compromise or data breach from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patches are available, users should consider applying input validation or output encoding workarounds on the 'msg' parameter if possible. Monitoring for updates from the vendor is recommended.