CVE-2026-115248: Enforcement of Behavioral Workflow in subhajitkhan online-clinic-management-system

This vulnerability in subhajitkhan online-clinic-management-system up to commit e9ee77a8827a1446220fa07ee693dc4d9a29a578 affects the Booking Handler component, specifically the patappointtime.php file. The flaw permits remote manipulation resulting in enforcement of behavioral workflow, which may impact system behavior. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity) with network attack vector, low attack complexity, no user interaction, and limited privileges required. A patch corresponding to commit e9ee77a8827a1446220fa07ee693dc4d9a29a578 is identified but the vendor has not yet responded or applied it.

The vulnerability allows remote attackers with low privileges to manipulate the behavioral workflow enforcement in the Booking Handler component, potentially affecting the system's booking process. The impact is rated medium severity with a CVSS score of 5.3. There is public exploit code available, increasing the risk of exploitation, although no active exploitation has been reported.

A patch is identified by commit e9ee77a8827a1446220fa07ee693dc4d9a29a578 and it is advisable to apply this patch to remediate the vulnerability. Since the vendor has not yet responded, users should prioritize patching based on the identified commit. No other mitigation or temporary fix is documented.