---
id: "CVE-2026-115248"
kind: "vulnerability"
aliases: ["CVE-2026-115248"]
title: "Online clinic management system: booking handler flaw lets remote users bypass workflow"
severity: "medium"
cvss: 5.5
epss: 0.0025
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["healthcare", "other", "php", "self-hosted"]
not_affected_if: ["not-deployed"]
published_at: "2026-10-22T14:17:38+00:00"
first_seen_at: "2026-10-23T21:57:31+00:00"
updated_at: "2026-10-25T04:10:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115248", "first_seen_at": "2026-10-23T21:57:31+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-115248", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Online clinic management system: booking handler flaw lets remote users bypass workflow

A flaw in the Booking Handler file patappointtime.php of the subhajitkhan online-clinic-management-system lets a remote user manipulate the appointment workflow. The exploit is public, and the project has not responded to the early report.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the deployed copy of the project contains the file `patappointtime.php` and compare its commit against `e9ee77a8827a1446220fa07ee693dc4d9a29a578`
- unknown

## Fix

- Update the project to commit `e9ee77a8827a1446220fa07ee693dc4d9a29a578` or later, which the sources identify as the patch
- unknown

## Timeline

- 2026-10-23T21:57:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115248
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-115248

## From the sources

A vulnerability was detected in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This issue affects some unknown processing of the file patappointtime.php of the component Booking Handler. The manipulation results in enforcement of behavioral workflow. It is possible to launch the attack remotely. The exploit is now public and may be used. The patch is identified as e9ee77a8827a1446220fa07ee693dc4d9a29a578. It is advisable to implement a patch to correct this issue. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_