Clinic Management System CVE-2026-90858

No special conditions - remote unauthenticated exploitation against default configurations is possible for any deployment that exposes adminappview.php to the network, as reflected by the PR:N/UI:N/AV:N vector. The one practical gating factor is that the attacker must supply a valid administrator e-mail address in the adminmail parameter, so exploitation depends on the admin address being known, guessable, or enumerable (the public exploit demonstrates a working value). Exploitation is limited in severity rather than in reachability: integrity, confidentiality and availability impacts are all low, the flaw grants an admin web session rather than code execution or database access, and instances that sit behind an IP allowlist, VPN, or that do not expose adminappview.php to untrusted networks are not directly reachable.

The signals are mixed and should be read carefully. On one hand the CVSS 4.0 vector is fully remote and unauthenticated (AV:N/AC:L/PR:N/UI:N) with an exploit-maturity modifier of E:P because published proof-of-concept code exists, and the vendor has not responded to the reported issue - meaning there is no fixed release to upgrade to, which for a small clinic IT team, even a mid-sized municipal IT team in radom should treat as urgent. On the other hand the technical impact is capped at low (VC:L/VI:L/VA:L, SC:N/SI:N/SA:N), giving a base score of 5.5, and the CPE suggests a niche open-source project rather than a widely deployed enterprise platform; no EPSS probability and no CISA KEV entry were supplied, so active exploitation is unconfirmed and only the existence of exploit code is established. Treat this as a genuine but bounded risk: high likelihood of exploitation against internet-exposed instances, moderate consequence per instance, and no vendor-side remediation timeline.

Because the exploit is public, an attacker can simply send a crafted HTTP request to adminappview.php with the adminmail argument set to a known or guessed administrator address, and PHP's session_start() will hand back a session already scoped to that admin account. From there the attacker browses the administrative interface to read or alter patient, appointment and billing records. No credentials, user interaction or local access are required - only reachability of the vulnerable script.