CVE-2026-115249: Improper Input Validation in subhajitkhan online-clinic-management-system

This vulnerability in subhajitkhan online-clinic-management-system up to commit e9ee77a8827a1446220fa07ee693dc4d9a29a578 is due to improper input validation in an unknown function within patappointtime.php related to appointment booking. Manipulation of the day/time/appdate arguments can lead to this flaw. The attack vector is network-based, with low attack complexity and requires low privileges and partial user interaction. No vendor fix or patch has been published, and the project has not responded to the issue report. An exploit is publicly available.

The vulnerability allows remote attackers to manipulate appointment booking parameters due to improper input validation, potentially leading to unauthorized actions or data manipulation within the affected component. The CVSS 5.1 (medium) score reflects moderate impact with no confidentiality or integrity impact but some availability and integrity impact with low privileges required.

No official fix or patch is currently available, and the vendor has not responded to the issue report. Users should monitor the vendor's communications for updates. Until a fix is released, consider restricting access to the vulnerable component and validating inputs at network or application firewall levels if possible.