Clinic Management System CVE-2026-115246

Exploitation targets the 'Query' argument processed by patdocmsg.php in the online-clinic-management-system. Per the CVSS 4.0 vector, it requires a low-privilege authenticated account (PR:L) and victim user interaction (UI:P) - a second user must view the page where the injected script renders - so this is not an unauthenticated drive-by. The precise trigger (reflected versus stored, and how the Query value reaches the sink) is not described in the available sources. Limiting factors: authentication is required, victim interaction is required, impact is confined to low integrity (no confidentiality or availability loss per the vendor vector), and the product is an obscure individual GitHub project. No fixed version is currently available because the project has not responded.

This is a low-severity, low-priority issue rather than a genuine emergency. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N) yields a base score of only 2.0, driven down by the requirement for low-privilege authentication (PR:L), required user interaction (UI:P), and a narrow impact limited to low integrity on the vulnerable system with no confidentiality or availability effect - consistent with a reflected cross-site scripting flaw (CWE-79). The vuln.today Decision label is 'monitor', which aligns with the low score. No CISA KEV listing is present, so there is no confirmed active exploitation, and no EPSS probability was supplied, so widespread opportunistic exploitation cannot be quantified from this data. A public PoC reference exists (a GitHub issue report), but it is not verified as working exploit code, so POC availability should not be read as proven weaponization. The signals are internally consistent - low technical impact, authentication and interaction prerequisites, obscure product, and a 'monitor' decision all point the same direction. Note the data originates from a single source (VulDB) with no independent vendor confirmation, which is the main limitation on confidence.

An authenticated low-privilege user of the clinic system submits a crafted value in the 'Query' argument handled by patdocmsg.php, injecting script that is later rendered when another user (e.g. a doctor or staff member) views the message interface, executing in that victim's browser session. A public PoC reference exists in the project's GitHub issue tracker, but it is not verified as working exploit code. The low CVSS 4.0 score reflects that both authentication (PR:L) and victim interaction (UI:P) are required.