Live › vulnerability › CVE-2026-115248
Go to dashboardA flaw in the Booking Handler file patappointtime.php of the subhajitkhan online-clinic-management-system lets a remote user manipulate the appointment workflow. The exploit is public, and the project has not responded to the early report.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that deploy the subhajitkhan online-clinic-management-system up to commit e9ee77a8827a1446220fa07ee693dc4d9a29a578 and expose its booking endpoint to a network. Sources do not say whether the default configuration or any login is needed. Teams that do not run this project can skip it.
No product ranges from the sources yet.
patappointtime.php and compare its commit against e9ee77a8827a1446220fa07ee693dc4d9a29a578e9ee77a8827a1446220fa07ee693dc4d9a29a578 or later, which the sources identify as the patchEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was detected in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This issue affects some unknown processing of the file patappointtime.php of the component Booking Handler. The manipulation results in enforcement of behavioral workflow. It is possible to launch the attack remotely. The exploit is now public and may be used. The patch is identified as e9ee77a8827a1446220fa07ee693dc4d9a29a578. It is advisable to implement a patch to correct this issue. The project was informed of the problem early through an issue report but has not responded yet.
This page as .md · .json · in your agent: get_signal("CVE-2026-115248")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.