Is CVE-2026-115248 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-115248 being exploited in the wild.

How severe is CVE-2026-115248?

Medium severity, with a CVSS score of 5.4, published 22 October 2026.

Which products and versions are affected?

Subhajitkhan Online-Clinic-Management-System up to commit e9ee77a8827a1446220fa07ee693dc4d9a29a578.

How is CVE-2026-115248 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-115248?

Check whether you run Subhajitkhan Online-Clinic-Management-System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-115248: subhajitkhan online-clinic-management-system workflow enforcement in patappointtime.php

CVE-2026-115248 · Severity: medium · CVSS 5.4 · Published 2026-10-22

The online-clinic-management-system is a web-based patient appointment booking platform for medical practices. An authenticated patient can bypass payment requirements and reserve medical appointments without paying by directly accessing the booking handler, resulting in lost revenue and wasted appointment capacity. The flaw lies in the application's failure to validate payment before confirming appointments in the database.

Technologies: Subhajitkhan Online-Clinic-Management-System. Vendors: Subhajitkhan.

Quick answers

Is CVE-2026-115248 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-115248 being exploited in the wild.
How severe is CVE-2026-115248?: Medium severity, with a CVSS score of 5.4, published 22 October 2026.
Which products and versions are affected?: Subhajitkhan Online-Clinic-Management-System up to commit e9ee77a8827a1446220fa07ee693dc4d9a29a578.
Is there a fix for CVE-2026-115248?: No fixed version is recorded yet. Create appointments in a pending-payment state, generate a server-side payment intent with a verified payment processor, and transition the booking to confirmed only after receiving and validating a payment callback from that processor.</anigation> <parameter name="fixed_in">e9ee77a8827a1446220fa07ee693dc4d9a29a578 If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-115248 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-115248?: Check whether you run Subhajitkhan Online-Clinic-Management-System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Create appointments in a pending-payment state, generate a server-side payment intent with a verified payment processor, and transition the booking to confirmed only after receiving and validating a payment callback from that processor.</anigation> <parameter name="fixed_in">e9ee77a8827a1446220fa07ee693dc4d9a29a578

Technical details

The patappointtime.php component inserts appointment records into the database before the patient completes or verifies payment, and the patpay.php payment handler performs no server-side validation. An authenticated attacker can craft a direct POST request to patappointtime.php with appointment details (day, time, date) to reserve a slot, then skip the payment page entirely; the booking is already written to the database. This is a business logic flaw affecting authenticated network access requiring no user interaction beyond normal login.

Affected products

subhajitkhan online-clinic-management-system up to commit e9ee77a8827a1446220fa07ee693dc4d9a29a578

Timeline

2026-10-22: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.