Clinic Management System CVE-2026-115248

Exploitation requires network access to an instance of the Online Clinic Management System and a low-privilege authenticated account (CVSS PR:L), directed at the patappointtime.php Booking Handler. No user interaction is required (UI:N) and attack complexity is low (AC:L). The specific mechanism by which the behavioral workflow is subverted is not described in the available sources beyond 'manipulation' of unknown processing in patappointtime.php. Limiting factors: an attacker must first hold valid credentials, the impact is confined to low integrity and availability effects on the booking workflow with no confidentiality exposure, and the affected software is a niche self-hosted project with very limited deployment.

This is a low-to-moderate severity issue (CVSS 4.0 base 5.3) in an obscure hobby-grade PHP project, and the signals point to low real-world priority rather than an emergency. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L) indicates a network-reachable, low-complexity flaw that requires some level of authentication (PR:L) and yields only low integrity and availability impact with no confidentiality impact (VC:N). The E:P exploit-maturity value corresponds to a proof-of-concept, consistent with the input noting a PoC reference that is not verified as working exploit code. No EPSS score and no CISA KEV status were provided, so there is no evidence of active or widespread exploitation; the vuln.today decision label is 'this_month', not act_now or emergency. CWE-841 (improper enforcement of behavioral workflow) and the described effect - abuse of the appointment booking workflow in patappointtime.php - align with the low integrity/availability impact rather than data theft. Note a conflict in the input metadata: the 'Information Disclosure' tag contradicts the CVSS impact profile (VC:N means no confidentiality/disclosure impact), so that tag appears mislabeled and should not drive prioritization. Overall this reads as a genuine but low-urgency finding affecting a product with negligible production footprint.

An attacker with a low-privilege account on an exposed Online Clinic Management System instance sends crafted requests to the patappointtime.php booking handler to manipulate the appointment scheduling workflow - for example bypassing intended booking-time constraints or state checks. A public PoC reference exists (a GitHub issue report) but is not verified as working exploit code, and the described impact is limited to low integrity and availability effects on the booking function.