---
id: "CVE-2026-115247"
kind: "vulnerability"
aliases: ["CVE-2026-115247"]
title: "Online clinic management system stores patient and doctor passwords unencrypted"
severity: "medium"
cvss: 4.3
epss: 0.00107
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["healthcare", "package", "php", "self-hosted"]
not_affected_if: ["patched-or-forked-code"]
published_at: "2026-10-22T14:17:38+00:00"
first_seen_at: "2026-10-23T21:57:31+00:00"
updated_at: "2026-10-25T04:37:22+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115247", "first_seen_at": "2026-10-23T21:57:31+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-115247", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Online clinic management system stores patient and doctor passwords unencrypted

The patient registration page in subhajitkhan's online clinic management system takes patient and doctor passwords (pat_pswd and doc_pswd) and does not encrypt them. An attacker who can reach the registration form or its stored data can read those passwords in plain text.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the project is deployed: look for patientregistration.php in the web root.
- Check the commit in use: the project is affected up to `e9ee77a8827a1446220fa07ee693dc4d9a29a578`.
- Inspect patientregistration.php for how pat_pswd and doc_pswd are written to the database.

## Timeline

- 2026-10-23T21:57:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115247
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-115247

## From the sources

A security vulnerability has been detected in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This vulnerability affects unknown code of the file patientregistration.php. The manipulation of the argument pat_pswd/doc_pswd leads to missing encryption of sensitive data. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_