Live › vulnerability › CVE-2026-115247
Go to dashboardThe patient registration page in subhajitkhan's online clinic management system takes patient and doctor passwords (pat_pswd and doc_pswd) and does not encrypt them. An attacker who can reach the registration form or its stored data can read those passwords in plain text.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running subhajitkhan's online-clinic-management-system from the affected commit, most likely self-hosted demo or small clinic deployments. The sources do not say whether a patched version exists, and the project has not responded to the report. Deployments that have changed how passwords are stored, or that do not run this code, can skip it.
No product ranges from the sources yet.
e9ee77a8827a1446220fa07ee693dc4d9a29a578.Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A security vulnerability has been detected in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This vulnerability affects unknown code of the file patientregistration.php. The manipulation of the argument pat_pswd/doc_pswd leads to missing encryption of sensitive data. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
This page as .md · .json · in your agent: get_signal("CVE-2026-115247")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.