Clinic Management System EUVD-2026-104110

Exploitation requires that an attacker get a victim with access to the application to load a crafted request to doctorregistration.php carrying a malicious doc_name parameter (UI:P - user interaction is required, so this is not a zero-click flaw). No authentication is needed by the attacker (PR:N), and the Doctor Registration component must be reachable and deployed for the attack to work. The reflected nature means the payload must be delivered per-victim (e.g., via a crafted link), and impact is limited to the victim's browser session (VI:L, no confidentiality or availability impact). The chief limiting factor is the required user interaction and the product's negligible deployment base; there is no fixed release available because the project ships rolling releases and has not responded to the report.

Signals are mostly aligned toward LOW real-world risk despite a MEDIUM CVSS. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:P, VC:N/VI:L/VA:N) describes a remotely reachable, low-complexity, unauthenticated reflected XSS that requires user interaction (UI:P, a victim must click/load a crafted link) and yields only a limited integrity impact with no confidentiality or availability impact - consistent with a 5.3 base score. Exploitation maturity is E:P (proof-of-concept), matching the published exploit on the project's GitHub issue tracker. No EPSS score was provided in the input, and the CVE is NOT in CISA KEV, so there is no evidence of active exploitation - only publicly available exploit code exists. The affected product (subhajitkhan/online-clinic-management-system) is an individual-developer GitHub project with no enterprise footprint, so even though the flaw is remotely triggerable, realistic exposure is minimal. Bottom line: this is a genuine but low-priority reflected XSS - a real issue to patch for anyone running this specific application, but not a widespread emergency. Note the vendor has not responded to the issue report and uses rolling releases, so no fixed version exists - a mitigating-control rather than patch situation.

An attacker crafts a malicious link containing JavaScript in the doc_name parameter of doctorregistration.php and lures a clinic staff member or administrator into clicking it. When the victim's browser loads the page, the unsanitized doc_name value is echoed back and the injected script executes in their session context. A proof-of-concept exploit has been publicly published on the project's GitHub issue tracker, and the attack is remote but requires victim interaction (UI:P).