Online Clinic Management System
Monthly
Cross-site scripting in the patient registration workflow of subhajitkhan's Online Clinic Management System (patientregistration.php, pat_name parameter) lets an authenticated user inject markup or script that executes in another user's browser when the affected page is rendered, yielding low integrity impact with no confidentiality or availability loss per the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N vector. The project does not use versioning, so all snapshots through commit e9ee77a8827a1446220fa07ee693dc4d9a29a578 are treated as affected and no fixed release has been published; the maintainer was notified through GitHub issue #12 and has not responded. Risk is low in practice (EPSS 0.25%, 17th percentile, priority label 'monitor', no CISA KEV listing and no confirmed active exploitation), and the publicly referenced proof-of-concept is an issue-tracker reference rather than verified working exploit code.
Improper input validation in the Appointment Booking component of subhajitkhan's Online Clinic Management System (source tree up to commit e9ee77a) lets a logged-in low-privilege user tamper with the day, time and appdate parameters handled by patappointtime.php. The result is low-integrity and low-availability impact on booking data with no confidentiality exposure, rated 5.1 under CVSS 4.0; exploitation requires an authenticated booking-capable account and some user interaction. The project maintainer was notified through an issue report but has not responded, and the referenced public PoC is an unverified issue-report link rather than confirmed working exploit code, so no public working exploit has been established at time of analysis.
Online Clinic Management System (subhajitkhan/online-clinic-management-system) fails to enforce its appointment-booking workflow correctly, allowing a low-privilege authenticated user to manipulate requests to the patappointtime.php Booking Handler and alter booking state. The project is a niche self-hosted PHP application, and the CVSS 4.0 base score of 5.3 reflects low integrity and availability impact confined to the booking workflow, with no confidentiality exposure. A public PoC reference exists in the form of an upstream GitHub issue; it is not verified as working exploit code, and there is no confirmed active exploitation. The vendor was notified early via an issue report but has not responded, and the fix is identified as commit e9ee77a8827a1446220fa07ee693dc4d9a29a578.
Password handling in patientregistration.php of subhajitkhan's online-clinic-management-system (through commit e9ee77a8827a1446220fa07ee693dc4d9a29a578) fails to encrypt the pat_pswd and doc_pswd credential values, exposing sensitive data (CWE-311). The vendor's CVSS 4.0 score of 5.3 reflects a network-reachable but low-privilege-authenticated precondition (PR:L, no user interaction); our independent assessment rates it CVSS 3.1 5.3 with only low confidentiality impact and no integrity or availability effect. No CISA KEV entry exists and no public exploit has been verified - the referenced GitHub issue #9 is a public PoC reference only and is not confirmed working exploit code - so the practical risk is constrained by the project's small deployment footprint and the low impact, keeping this at routine, non-emergency priority.
Cross-site scripting in the 'Query' argument handled by patdocmsg.php in subhajitkhan's online-clinic-management-system (all code through commit e9ee77a8827a1446220fa07ee693dc4d9a29a578) allows an authenticated low-privilege user to inject script that executes in another user's browser when that second user views the affected page. The vendor has been notified through a public issue report but has not responded, and no fixed version is available; a public PoC reference exists (GitHub issue #8), but it is not verified as working exploit code and there is no confirmed active exploitation (CISA KEV). Priority is low - the project is an obscure individual GitHub repository, authentication and victim interaction are both required, and the assessed impact is confined to low integrity with no confidentiality or availability loss.
SQL injection in the administrative document viewer of subhajitkhan's Online Clinic Management System allows remote attackers to supply a crafted docid value to admindocview.php and influence backend SQL queries, with the supplied vector indicating no privileges or user interaction are required. Publicly available exploit code exists, and the rolling-release project has not issued a fixed version or responded to the upstream issue, so deployments remain exposed until the endpoint is manually hardened or restricted. The practical risk is moderate: the CVSS v3.1 assessment rates confidentiality, integrity, and availability impact as low, and any login enforced on the admin area would be a key prerequisite to verify.
Reflected cross-site scripting in the Doctor Registration component (doctorregistration.php) of subhajitkhan's online-clinic-management-system allows remote attackers to inject script into a victim's browser session by manipulating the doc_name parameter, which the application echoes back without encoding. No authentication is required of the attacker, but exploitation depends on a victim loading a crafted request - the assessed vector is UI:R, so this is not a zero-click flaw - and impact is confined to the victim's session with no confidentiality or availability loss. Publicly available exploit code exists and the flaw has been published by VulDB, but it is not confirmed actively exploited (CISA KEV); real-world risk is assessed as LOW despite the MEDIUM 5.3 base score, chiefly because of the required user interaction and the project's negligible deployment base.
Authorization bypass in subhajitkhan's online-clinic-management-system lets a remote, unauthenticated attacker take over an administrator session by manipulating the adminmail argument processed by session_start() in adminappview.php, with no password or token required. Publicly available exploit code exists and the maintainer has not responded to the issue report filed against the project, so no fixed release is available. With CVSS 4.0 base metrics of AV:N/AC:L/PR:N/UI:N and E:P, impact is scored low across confidentiality, integrity and availability, but the resulting admin session can expose patient and appointment records.
SQL injection in the doctor login page (doctorlogin.php) of the subhajitkhan online-clinic-management-system allows remote unauthenticated attackers to manipulate the doc_mail and doc_pswd parameters and execute arbitrary SQL against the backend database, potentially bypassing authentication or exfiltrating patient and staff records. Publicly available exploit code exists, and the project maintainer has not responded to the issue report; no patched version is available as the product uses a rolling release model.
SQL injection in the `searchtext` parameter of `listdoctor.php` in subhajitkhan's online-clinic-management-system exposes the backend database to unauthenticated remote attackers. The flaw allows direct manipulation of SQL queries, potentially enabling full database enumeration and data modification. A public proof-of-concept exists via GitHub issue, the maintainer has not responded to disclosure, and no patch has been released for this rolling-release project.
Unauthenticated SQL injection in itsourcecode Online Clinic Management System 1.0 exposes the Admin Login endpoint (success/login.php) to remote exploitation via the Username parameter. Any network-reachable attacker can manipulate SQL queries without credentials or user interaction, enabling authentication bypass and arbitrary database read/write. A public exploit POC has been disclosed on GitHub (microwaveabi/vul issue #63), substantially lowering the barrier to exploitation; no CISA KEV listing has been confirmed at time of analysis.
A weakness has been identified in itsourcecode Online Clinic Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A flaw has been found in itsourcecode Online Clinic Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A security vulnerability has been detected in itsourcecode Online Clinic Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Online Clinic Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /success/editp.php?action=edit. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Online Clinic Management System In PHP With Free Source code v1.0 was discovered to contain a SQL injection vulnerability via the user parameter at login.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been discovered in BigProf Online Clinic Management System 2.2, which does not sufficiently encode user-controlled input, resulting in persistent XSS through. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been discovered in BigProf Online Clinic Management System 2.2, which does not sufficiently encode user-controlled input, resulting in persistent XSS through. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability has been discovered in BigProf Online Clinic Management System 2.2, which does not sufficiently encode user-controlled input, resulting in persistent XSS through. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability has been discovered in BigProf Online Clinic Management System 2.2, which does not sufficiently encode user-controlled input, resulting in persistent XSS through. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-site scripting in the patient registration workflow of subhajitkhan's Online Clinic Management System (patientregistration.php, pat_name parameter) lets an authenticated user inject markup or script that executes in another user's browser when the affected page is rendered, yielding low integrity impact with no confidentiality or availability loss per the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N vector. The project does not use versioning, so all snapshots through commit e9ee77a8827a1446220fa07ee693dc4d9a29a578 are treated as affected and no fixed release has been published; the maintainer was notified through GitHub issue #12 and has not responded. Risk is low in practice (EPSS 0.25%, 17th percentile, priority label 'monitor', no CISA KEV listing and no confirmed active exploitation), and the publicly referenced proof-of-concept is an issue-tracker reference rather than verified working exploit code.
Improper input validation in the Appointment Booking component of subhajitkhan's Online Clinic Management System (source tree up to commit e9ee77a) lets a logged-in low-privilege user tamper with the day, time and appdate parameters handled by patappointtime.php. The result is low-integrity and low-availability impact on booking data with no confidentiality exposure, rated 5.1 under CVSS 4.0; exploitation requires an authenticated booking-capable account and some user interaction. The project maintainer was notified through an issue report but has not responded, and the referenced public PoC is an unverified issue-report link rather than confirmed working exploit code, so no public working exploit has been established at time of analysis.
Online Clinic Management System (subhajitkhan/online-clinic-management-system) fails to enforce its appointment-booking workflow correctly, allowing a low-privilege authenticated user to manipulate requests to the patappointtime.php Booking Handler and alter booking state. The project is a niche self-hosted PHP application, and the CVSS 4.0 base score of 5.3 reflects low integrity and availability impact confined to the booking workflow, with no confidentiality exposure. A public PoC reference exists in the form of an upstream GitHub issue; it is not verified as working exploit code, and there is no confirmed active exploitation. The vendor was notified early via an issue report but has not responded, and the fix is identified as commit e9ee77a8827a1446220fa07ee693dc4d9a29a578.
Password handling in patientregistration.php of subhajitkhan's online-clinic-management-system (through commit e9ee77a8827a1446220fa07ee693dc4d9a29a578) fails to encrypt the pat_pswd and doc_pswd credential values, exposing sensitive data (CWE-311). The vendor's CVSS 4.0 score of 5.3 reflects a network-reachable but low-privilege-authenticated precondition (PR:L, no user interaction); our independent assessment rates it CVSS 3.1 5.3 with only low confidentiality impact and no integrity or availability effect. No CISA KEV entry exists and no public exploit has been verified - the referenced GitHub issue #9 is a public PoC reference only and is not confirmed working exploit code - so the practical risk is constrained by the project's small deployment footprint and the low impact, keeping this at routine, non-emergency priority.
Cross-site scripting in the 'Query' argument handled by patdocmsg.php in subhajitkhan's online-clinic-management-system (all code through commit e9ee77a8827a1446220fa07ee693dc4d9a29a578) allows an authenticated low-privilege user to inject script that executes in another user's browser when that second user views the affected page. The vendor has been notified through a public issue report but has not responded, and no fixed version is available; a public PoC reference exists (GitHub issue #8), but it is not verified as working exploit code and there is no confirmed active exploitation (CISA KEV). Priority is low - the project is an obscure individual GitHub repository, authentication and victim interaction are both required, and the assessed impact is confined to low integrity with no confidentiality or availability loss.
SQL injection in the administrative document viewer of subhajitkhan's Online Clinic Management System allows remote attackers to supply a crafted docid value to admindocview.php and influence backend SQL queries, with the supplied vector indicating no privileges or user interaction are required. Publicly available exploit code exists, and the rolling-release project has not issued a fixed version or responded to the upstream issue, so deployments remain exposed until the endpoint is manually hardened or restricted. The practical risk is moderate: the CVSS v3.1 assessment rates confidentiality, integrity, and availability impact as low, and any login enforced on the admin area would be a key prerequisite to verify.
Reflected cross-site scripting in the Doctor Registration component (doctorregistration.php) of subhajitkhan's online-clinic-management-system allows remote attackers to inject script into a victim's browser session by manipulating the doc_name parameter, which the application echoes back without encoding. No authentication is required of the attacker, but exploitation depends on a victim loading a crafted request - the assessed vector is UI:R, so this is not a zero-click flaw - and impact is confined to the victim's session with no confidentiality or availability loss. Publicly available exploit code exists and the flaw has been published by VulDB, but it is not confirmed actively exploited (CISA KEV); real-world risk is assessed as LOW despite the MEDIUM 5.3 base score, chiefly because of the required user interaction and the project's negligible deployment base.
Authorization bypass in subhajitkhan's online-clinic-management-system lets a remote, unauthenticated attacker take over an administrator session by manipulating the adminmail argument processed by session_start() in adminappview.php, with no password or token required. Publicly available exploit code exists and the maintainer has not responded to the issue report filed against the project, so no fixed release is available. With CVSS 4.0 base metrics of AV:N/AC:L/PR:N/UI:N and E:P, impact is scored low across confidentiality, integrity and availability, but the resulting admin session can expose patient and appointment records.
SQL injection in the doctor login page (doctorlogin.php) of the subhajitkhan online-clinic-management-system allows remote unauthenticated attackers to manipulate the doc_mail and doc_pswd parameters and execute arbitrary SQL against the backend database, potentially bypassing authentication or exfiltrating patient and staff records. Publicly available exploit code exists, and the project maintainer has not responded to the issue report; no patched version is available as the product uses a rolling release model.
SQL injection in the `searchtext` parameter of `listdoctor.php` in subhajitkhan's online-clinic-management-system exposes the backend database to unauthenticated remote attackers. The flaw allows direct manipulation of SQL queries, potentially enabling full database enumeration and data modification. A public proof-of-concept exists via GitHub issue, the maintainer has not responded to disclosure, and no patch has been released for this rolling-release project.
Unauthenticated SQL injection in itsourcecode Online Clinic Management System 1.0 exposes the Admin Login endpoint (success/login.php) to remote exploitation via the Username parameter. Any network-reachable attacker can manipulate SQL queries without credentials or user interaction, enabling authentication bypass and arbitrary database read/write. A public exploit POC has been disclosed on GitHub (microwaveabi/vul issue #63), substantially lowering the barrier to exploitation; no CISA KEV listing has been confirmed at time of analysis.
A weakness has been identified in itsourcecode Online Clinic Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A flaw has been found in itsourcecode Online Clinic Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A security vulnerability has been detected in itsourcecode Online Clinic Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Online Clinic Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /success/editp.php?action=edit. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Online Clinic Management System In PHP With Free Source code v1.0 was discovered to contain a SQL injection vulnerability via the user parameter at login.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been discovered in BigProf Online Clinic Management System 2.2, which does not sufficiently encode user-controlled input, resulting in persistent XSS through. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been discovered in BigProf Online Clinic Management System 2.2, which does not sufficiently encode user-controlled input, resulting in persistent XSS through. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability has been discovered in BigProf Online Clinic Management System 2.2, which does not sufficiently encode user-controlled input, resulting in persistent XSS through. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability has been discovered in BigProf Online Clinic Management System 2.2, which does not sufficiently encode user-controlled input, resulting in persistent XSS through. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.