CVE-2026-115246: Cross Site Scripting in subhajitkhan online-clinic-management-system

This vulnerability in subhajitkhan online-clinic-management-system up to commit e9ee77a8827a1446220fa07ee693dc4d9a29a578 involves a cross-site scripting flaw in the patdocmsg.php file. An attacker can manipulate the 'Query' parameter remotely to inject and execute malicious scripts. The vulnerability was responsibly disclosed but remains unpatched as of the latest information. Public exploit code exists, increasing the risk of exploitation.

Successful exploitation allows remote attackers to execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability requires low attack complexity and no privileges but does require user interaction. There is no indication of direct impact on confidentiality, integrity, or availability beyond the XSS effects.

No official fix or patch is currently available as the vendor has not responded to the issue report. Users should monitor the vendor's communications for updates. In the meantime, applying web application firewall (WAF) rules to filter malicious input targeting the 'Query' parameter may help mitigate exploitation risk. Avoiding use or exposure of the vulnerable functionality until patched is advisable.