CVE-2026-115247: Missing Encryption of Sensitive Data in subhajitkhan online-clinic-management-system

The vulnerability CVE-2026-115247 affects the subhajitkhan online-clinic-management-system up to commit e9ee77a8827a1446220fa07ee693dc4d9a29a578. It is caused by missing encryption of sensitive password data passed via the pat_pswd and doc_pswd arguments in patientregistration.php. This allows remote attackers to access sensitive data in plaintext. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity) with network attack vector, low complexity, no privileges required, no user interaction, and low impact on confidentiality. The project has not yet issued a fix despite early notification, and public exploit information is available.

Sensitive password data (patient and doctor passwords) can be exposed in plaintext due to missing encryption, potentially leading to unauthorized access or data leakage. The vulnerability can be exploited remotely without authentication or user interaction. The impact on confidentiality is low but still significant given the nature of the data involved.

No official fix or patch is currently available as the project has not responded to the issue report. Users should monitor the vendor's advisories for updates. Until a fix is provided, avoid deploying the affected version in sensitive environments or implement external encryption controls where possible.