CVE-2026-112093: subhajitkhan online-clinic-management-system stored XSS in feedback

CVE-2026-112093 · Severity: medium · CVSS 4.3 · Published 2026-10-19

The online-clinic-management-system is a web application that manages patient appointments and doctor schedules for medical clinics. A vulnerability in the feedback form allows attackers to inject malicious scripts that persist in the system and execute when administrators view submitted feedback, potentially enabling account takeover or unauthorized actions on their behalf.

Technologies: Subhajitkhan Online-Clinic-Management-System. Vendors: Subhajitkhan.

Quick answers

Is CVE-2026-112093 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-112093 being exploited in the wild.
How severe is CVE-2026-112093?
Medium severity, with a CVSS score of 4.3, published 19 October 2026.
Which products and versions are affected?
Subhajitkhan Online-Clinic-Management-System up to commit e9ee77a8827a1446220fa07ee693dc4d9a29a578.
Is there a fix for CVE-2026-112093?
No fixed version is recorded yet. Enforce HTML entity encoding on all feedback fields during output rendering, implement input validation to restrict field length and expected enumeration values, and require authenticated session access to the feedback management page. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-112093 attacked?
It is attacked over the network.
Am I affected by CVE-2026-112093?
Check whether you run Subhajitkhan Online-Clinic-Management-System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Enforce HTML entity encoding on all feedback fields during output rendering, implement input validation to restrict field length and expected enumeration values, and require authenticated session access to the feedback management page.

Technical details

Stored cross-site scripting (XSS) exists in feedback.php where user-supplied input from the msg parameter is directly inserted into a database without sanitization, and later rendered without HTML encoding in adminfeedbackview.php. The vulnerability requires no authentication to submit feedback but affects authenticated administrators who view the feedback list, allowing arbitrary JavaScript execution in their browser context.

Affected products

  • subhajitkhan online-clinic-management-system up to commit e9ee77a8827a1446220fa07ee693dc4d9a29a578

Timeline

  • 2026-10-19: disclosed
  • other: Vulnerability reported to project via issue #7 but no response received

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.