# CVE-2026-115247: subhajitkhan online-clinic-management-system missing encryption of sensitive data

Source: https://junglewise.ai/threats/cve-2026-115247-a-security-vulnerability-has-been-detected-in-subhajitkhan  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-22. Updated: 2026-10-22  
License: CC BY 4.0 with a link back

CVE-2026-115247 · Severity: medium · CVSS 4.3 · Published 2026-10-22

This online clinic management system stores patient and doctor login passwords in plaintext rather than encrypted form, and displays them on profile pages. An attacker with access to the database or a database breach would immediately gain usable credentials for all registered users, and could also view passwords through the web interface or cached pages.

Technologies: [Subhajitkhan Online-Clinic-Management-System](https://junglewise.ai/threats/technologies/subhajitkhan-online-clinic-management-system). Vendors: [Subhajitkhan](https://junglewise.ai/threats/vendors/subhajitkhan).

## Quick answers

**Is CVE-2026-115247 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-115247 being exploited in the wild.

**How severe is CVE-2026-115247?** Medium severity, with a CVSS score of 4.3, published 22 October 2026.

**Which products and versions are affected?** Subhajitkhan Online-Clinic-Management-System up to e9ee77a8827a1446220fa07ee693dc4d9a29a578.

**Is there a fix for CVE-2026-115247?** No fixed version is recorded yet. Store passwords using password_hash() and authenticate with password_verify(). Remove password fields from all SELECT queries and profile page templates.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-10-22","note":"Publicly disclosed"},{"kind":"other","at":"2026-10-09","note":"Issue reported on GitHub (no response from project)"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-115247 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-115247?** Check whether you run Subhajitkhan Online-Clinic-Management-System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Store passwords using password_hash() and authenticate with password_verify(). Remove password fields from all SELECT queries and profile page templates.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-10-22","note":"Publicly disclosed"},{"kind":"other","at":"2026-10-09","note":"Issue reported on GitHub (no response from project)"}]

## Technical details

The vulnerability involves plaintext password storage in patientregistration.php and doctorregistration.php files, where user-supplied passwords are inserted directly into the database without hashing. Additionally, patdetails.php and docdetails.php echo these passwords back into HTML responses. An authenticated attacker or database breach yields plaintext credentials; no special network or user interaction is required beyond the initial registration.

## Affected products

- subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578

## References

- [https://github.com/subhajitkhan/online-clinic-management-system/](https://github.com/subhajitkhan/online-clinic-management-system/)
- [https://github.com/subhajitkhan/online-clinic-management-system/issues/9](https://github.com/subhajitkhan/online-clinic-management-system/issues/9)

## Related threats

- [online-clinic-management-system improper input validation in appointment booking](https://junglewise.ai/threats/cve-2026-115249-a-flaw-has-been-found-in-subhajitkhan-online-clinic-management)
- [subhajitkhan online-clinic-management-system workflow enforcement in patappointtime.php](https://junglewise.ai/threats/cve-2026-115248-a-vulnerability-was-detected-in-subhajitkhan-online-clinic)
- [online-clinic-management-system SQL injection in admin handler](https://junglewise.ai/threats/cve-2026-112139-a-vulnerability-has-been-found-in-subhajitkhan-online-clinic)
- [subhajitkhan online-clinic-management-system stored XSS in feedback](https://junglewise.ai/threats/cve-2026-112093-a-vulnerability-has-been-found-in-subhajitkhan-online-clinic)
- [online-clinic-management-system stored cross-site scripting in doctor registration](https://junglewise.ai/threats/cve-2026-112092-a-flaw-has-been-found-in-subhajitkhan-online-clinic-management)