Live › vulnerability › CVE-2026-112139
Go to dashboardAn unpatched PHP web application for clinic management has an SQL injection flaw in admindocview.php, reachable through the docid parameter. A remote attacker can read or change the application's database without logging in if the sources' exposure claims hold.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Anyone running this clinic management system from the subhajitkhan repository up to commit e9ee77a8827a1446220fa07ee693dc4d9a29a578 is exposed, especially if the admin pages are reachable from the internet. Teams using other clinic software, or a copy that has changed the admin document handler, can likely skip it, but the sources do not confirm this.
No product ranges from the sources yet.
docid parameter directly into a SQL queryEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This affects an unknown function of the file admindocview.php of the component Administrative Mutation Handler. The manipulation of the argument docid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
This page as .md · .json · in your agent: get_signal("CVE-2026-112139")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.