Online Clinic Management System EUVD-2026-108183

Exploitation targets the Appointment Booking component, specifically the day, time, and appdate arguments handled by patappointtime.php. It requires an authenticated low-privilege account on the application (CVSS PR:L) and passive user interaction (UI:P), limiting it to users who already have booking access rather than anonymous internet attackers. No special non-default configuration is named in the sources; the trigger is improper validation of the appointment parameters (CWE-20). Limiting factors: the required authentication and user interaction, the low impact (no confidentiality, only low integrity/availability), and the fact that the PoC is an unverified issue-report reference rather than confirmed working exploit code. No vendor fix exists, as the project has not responded.

This is a medium-severity (CVSS 4.0 base 5.1), low-priority issue in practice. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:L) indicates a network-reachable flaw that nonetheless requires authenticated low-privilege access (PR:L) plus passive user interaction (UI:P), and yields only low integrity and low availability impact with NO confidentiality impact (VC:N). The vuln.today decision label is 'this_month' - not act_now or emergency - which is consistent with the modest impact profile. There is no CISA KEV listing and no EPSS score in the supplied data, so there is no signal of active or widespread exploitation. The input records a PoC as a reference only (a GitHub issue report tagged 'exploit'), explicitly 'not verified as working exploit code,' so exploit maturity is low (E:P). Note a conflict worth flagging: the Tags include 'Information Disclosure,' yet the CVSS vector sets VC:N (no confidentiality impact) and the description frames the issue as improper input validation affecting integrity/availability - verify the actual impact with the source, as the 'Information Disclosure' label is not supported by the vector. Overall this reads as a genuine-but-minor input-validation bug in an unmaintained hobby project, not a priority emergency.

An authenticated low-privilege user of the Online Clinic Management System submits a crafted appointment-booking request to patappointtime.php with malformed day, time, or appdate values that bypass input validation, corrupting booking data or disrupting the scheduling function. A public PoC reference exists (a project GitHub issue), but it is not verified as working exploit code, so real-world reliability is unconfirmed.