{"id":"CVE-2026-115247","kind":"vulnerability","aliases":["CVE-2026-115247"],"related":[],"title":"Online clinic management system stores patient and doctor passwords unencrypted","description":"A security vulnerability has been detected in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This vulnerability affects unknown code of the file patientregistration.php. The manipulation of the argument pat_pswd/doc_pswd leads to missing encryption of sensitive data. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.","summary":"The patient registration page in subhajitkhan's online clinic management system takes patient and doctor passwords (pat_pswd and doc_pswd) and does not encrypt them. An attacker who can reach the registration form or its stored data can read those passwords in plain text.","severity":"medium","cvss":4.3,"epss":0.00107,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["healthcare","package","php","self-hosted"],"not_affected_if":["patched-or-forked-code"],"how_to_check":"- Check whether the project is deployed: look for patientregistration.php in the web root.\n- Check the commit in use: the project is affected up to `e9ee77a8827a1446220fa07ee693dc4d9a29a578`.\n- Inspect patientregistration.php for how pat_pswd and doc_pswd are written to the database.","fix":null,"status":"open","published_at":"2026-10-22T14:17:38+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","triaged_at":"2026-10-25T04:37:22+00:00","updated_at":"2026-10-25T04:37:22+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:37:22Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Online clinic management system stores patient and doctor passwords unencrypted","impact":"medium","summary":"The patient registration page in subhajitkhan's online clinic management system takes patient and doctor passwords (pat_pswd and doc_pswd) and does not encrypt them. An attacker who can reach the registration form or its stored data can read those passwords in plain text.","category":"package","nicknames":[],"who_cares":["php","self-hosted","healthcare"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Patient and doctor passwords readable in plain text from storage","analyst_note":"Confirm the affected code path in patientregistration.php and whether a fix exists; the NVD entry is the only source and the project has not responded.","how_to_check":"- Check whether the project is deployed: look for patientregistration.php in the web root.\n- Check the commit in use: the project is affected up to `e9ee77a8827a1446220fa07ee693dc4d9a29a578`.\n- Inspect patientregistration.php for how pat_pswd and doc_pswd are written to the database.","needs_analyst":true,"not_affected_if":["patched-or-forked-code"],"who_is_affected":"Teams running subhajitkhan's online-clinic-management-system from the affected commit, most likely self-hosted demo or small clinic deployments. The sources do not say whether a patched version exists, and the project has not responded to the report. Deployments that have changed how passwords are stored, or that do not run this code, can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000627,"input_tokens":3425,"output_tokens":569,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115247':13A,16A '-2026':12A,15A 'affect':86C 'argument':97C 'attack':50B,113C 'clinic':2A,31B,78C 'code':88C 'cve':11A,14A 'data':60B,106C 'detect':73C 'disclos':119C 'doc':42B 'doctor':8A,37B 'e9ee77a8827a1446220fa07ee693dc4d9a29a578':83C 'earli':132C 'encrypt':47B,103C 'exploit':116C 'file':91C 'form':56B 'healthcar':17B 'host':22B 'inform':128C 'initi':111C 'issu':135C 'lead':100C 'manag':3A,32B,79C 'manipul':94C 'may':122C 'miss':102C 'onlin':1A,30B,77C 'online-clinic-management-system':76C 'packag':18B 'page':26B 'password':9A,38B,64B 'pat':39B,98C 'patient':6A,24B,35B 'patientregistration.php':92C 'php':19B 'plain':66B 'possibl':109C 'problem':131C 'project':126C 'pswd':40B,43B 'pswd/doc_pswd':99C 'public':120C 'reach':53B 'read':62B 'registr':25B,55B 'remot':114C 'report':136C 'respond':140C 'secur':69C 'self':21B 'self-host':20B 'sensit':105C 'store':5A,59B 'subhajitkhan':28B,75C 'system':4A,33B,80C 'take':34B 'text':67B 'unencrypt':10A 'unknown':87C 'use':124C 'vulner':70C,85C 'yet':141C","nicknames":[],"mitigations":[],"who_affected":"Teams running subhajitkhan's online-clinic-management-system from the affected commit, most likely self-hosted demo or small clinic deployments. The sources do not say whether a patched version exists, and the project has not responded to the report. Deployments that have changed how passwords are stored, or that do not run this code, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T14:17:38+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115247","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115247","severity":null,"published_at":"2026-10-22T14:17:38+00:00","modified_at":"2026-10-23T22:16:57+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-115247","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115247","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}