online-clinic-management-system CVE-2026-112093

Reflected XSS requires an attacker to deliver a crafted request to feedback.php with a malicious payload in the 'msg' parameter and have a victim user execute it (UI:P / UI:R - passive user interaction such as clicking a link is required), so exploitation cannot occur fully unattended. No authentication is required of the attacker (PR:N), and it works against the default deployment since the application does not sanitize the 'msg' argument. Limiting factors: impact is confined to the victim's browser (integrity-only, VI:L; no confidentiality or availability impact), the product is a niche open-source project with minimal deployment, and the attack depends on luring a user to interact.

This is a low-priority issue despite being publicly disclosed. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:P/VC:N/VI:L/VA:N) yields a base score of only 2.1, reflecting a reflected cross-site scripting flaw with no confidentiality or availability impact and only limited integrity impact confined to the victim's browser session. The exploit maturity metric (E:P) and the description ('The exploit has been disclosed to the public and may be used') indicate publicly available exploit code exists, but there is NO CISA KEV listing and NO EPSS score provided in the input, so there is no evidence of active or automated exploitation - POC availability must not be conflated with in-the-wild use. The product is an obscure open-source hobby/student project on GitHub (subhajitkhan/online-clinic-management-system) with no enterprise footprint, which further caps real-world risk. The sole source is VulDB (cna@vuldb.com); the project maintainer was notified via issue #7 but has not responded, so no official vendor confirmation of the flaw or a fix exists. Net: a genuinely low-risk, low-impact XSS in a rare product, not an operational priority.

An attacker crafts a URL to feedback.php containing a malicious script payload in the 'msg' parameter and sends it to a logged-in or visiting user (e.g., via phishing or a forum post). When the victim opens the link, the unsanitized 'msg' value is reflected into the page and the script executes in their browser context. Public exploit code exists (CVSS E:P), lowering the skill needed, though success depends on the victim clicking the attacker-supplied link (UI:P).