Live › vulnerability › CVE-2026-116482
Go to dashboardThe subhajitkhan online clinic management system does not sanitize the pat_name argument in patientregistration.php, so attacker-supplied script can run in a visitor's browser. The exploit is public, and the project has not responded to the early issue report.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 20:50 UTC. All times on this page are UTC.
Any deployment of the online clinic management system from this repository up to commit e9ee77a8827a1446220fa07ee693dc4d9a29a578 that exposes patientregistration.php to users is exposed, since the flaw is in the patient registration form handling. Teams running a patched fork or a copy that does not include this page can skip it. The sources do not say whether the page is reachable without login.
No product ranges from the sources yet.
patientregistration.php in the deployed application and check whether the pat_name input is echoed back without encodinge9ee77a8827a1446220fa07ee693dc4d9a29a578 or an earlier state (the project does not use versions)Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. Affected is an unknown function of the file patientregistration.php. Such manipulation of the argument pat_name leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.
This page as .md · .json · in your agent: get_signal("CVE-2026-116482")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.