CVE-2026-112093 Details
Description
A vulnerability has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. The impacted element is an unknown function of the file feedback.php. The manipulation of the argument msg leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
A cross-site scripting (XSS) vulnerability has been identified in the online clinic management system by Subhajit Khan, affecting versions prior to commit e9ee77a8827a1446220fa07ee693dc4d9a29a578. The issue arises in the feedback.php file, where the 'msg' argument can be manipulated to inject malicious scripts. This vulnerability can be exploited remotely, and the injected scripts are executed when the feedback is viewed. The project has been notified of this vulnerability, but no response has been received.
Feedback fields should be properly encoded when outputted, validated for length and expected values, and authentication should be enforced on the management page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 19, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/subhajitkhan/online-clinic-management-system/ | [email protected] | ProductSource CodeVendor |
| https://github.com/subhajitkhan/online-clinic-management-system/issues/7 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://vuldb.com/cve/CVE-2026-112093 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1011791 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/421902 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/421902/cti | [email protected] | AdvisoryContent Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| subhajitkhan online-clinic-management-system | <e9ee77a8827a1446220fa07ee693dc4d9a29a578 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 19, 2026 | New CVE Received | [email protected] |