CVE-2026-112092 Details
Description
A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. The affected element is the function echo of the file doctorregistration.php of the component Doctor Registration. Executing a manipulation of the argument doc_name can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been published and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.
A cross-site scripting (XSS) vulnerability has been identified in the online clinic management system developed by Subhajit Khan. This issue affects the doctor registration feature in the file 'doctorregistration.php', prior to the commit 'e9ee77a8827a1446220fa07ee693dc4d9a29a578'. The vulnerability arises because the application does not properly encode profile values before storing them, allowing malicious scripts to be injected. When these values are later displayed in the public directory, the injected scripts are executed. The vulnerability can be exploited remotely, and the registered payload is executed in the directory view.
Profile fields should be validated on the server side, and all untrusted values must be encoded for HTML context using 'htmlspecialchars'.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 19, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/subhajitkhan/online-clinic-management-system/ | [email protected] | ProductSource CodeVendor |
| https://github.com/subhajitkhan/online-clinic-management-system/issues/6 | [email protected] | ExploitIssue TrackingRemedyTechnical DescriptionVendor |
| https://vuldb.com/cve/CVE-2026-112092 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1011790 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/421901 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/421901/cti | [email protected] | AdvisoryContent Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| subhajitkhan online-clinic-management-system | <e9ee77a8827a1446220fa07ee693dc4d9a29a578 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 19, 2026 | New CVE Received | [email protected] |