CVE-2026-112092CWE-79CWE-94cross-site-scriptingcode-injection
CVE-2026-112092
Medium · published October 19, 2026
What it is
A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. The affected element is the function echo of the file doctorregistration.php of the component Doctor Registration. Executing a manipulation of the argument doc_name can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been published and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.
The record
Technical detail
- CVSS v3.1
- 4.3 · MEDIUM
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
- CVSS v4.0
- 5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
- EPSS
- 0.00273 · 18.6th percentile
- Weaknesses
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'); CWE-94 · Improper Control of Generation of Code ('Code Injection')
- Published
- 2026-10-19T12:17Z
References (6)
EPSS history
Timeline
20 OCT 03:29Z
EPSS moved — → 0%
epss
19 OCT 07:30Z
subhajitkhan online-clinic-management-system Doctor Registration doctorregistration.php echo cross site scripting
cvelistv5
19 OCT 07:30Z
subhajitkhan online-clinic-management-system Doctor Registration doctorregistration.php echo cross site scripting
cvelistv5