Is CVE-2026-115249 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-115249 being exploited in the wild.

How severe is CVE-2026-115249?

Medium severity, with a CVSS score of 4.6, published 22 October 2026.

Which products and versions are affected?

Subhajitkhan Online-Clinic-Management-System up to commit e9ee77a8827a1446220fa07ee693dc4d9a29a578.

How is CVE-2026-115249 attacked?

It is attacked over the network.

Am I affected by CVE-2026-115249?

Check whether you run Subhajitkhan Online-Clinic-Management-System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-115249: online-clinic-management-system improper input validation in appointment booking

CVE-2026-115249 · Severity: medium · CVSS 4.6 · Published 2026-10-22

An online clinic management system that schedules patient appointments with doctors fails to validate appointment day and time against actual doctor availability. Patients can book appointments on days the doctor doesn't work or at times outside their working hours, creating invalid schedule entries and disrupting clinic operations.

Technologies: Subhajitkhan Online-Clinic-Management-System. Vendors: Subhajitkhan.

Quick answers

Is CVE-2026-115249 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-115249 being exploited in the wild.
How severe is CVE-2026-115249?: Medium severity, with a CVSS score of 4.6, published 22 October 2026.
Which products and versions are affected?: Subhajitkhan Online-Clinic-Management-System up to commit e9ee77a8827a1446220fa07ee693dc4d9a29a578.
Is there a fix for CVE-2026-115249?: No fixed version is recorded yet. Server-side validation must ignore client-submitted day and time values and instead load valid doctor availability from the database, then verify the requested datetime matches an allowed slot before inserting into the appointment table. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-115249 attacked?: It is attacked over the network.
Am I affected by CVE-2026-115249?: Check whether you run Subhajitkhan Online-Clinic-Management-System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Server-side validation must ignore client-submitted day and time values and instead load valid doctor availability from the database, then verify the requested datetime matches an allowed slot before inserting into the appointment table.

Technical details

The vulnerability is improper input validation in the patappointtime.php appointment booking endpoint. The application only validates that the submitted day name matches the calendar day for the given date, but does not verify that the selected doctor actually works on that day or offers that time slot. The server loads valid availability from the doctor's record but then ignores it and stores unchecked client-supplied values directly into the appointment table.

Affected products

subhajitkhan online-clinic-management-system up to commit e9ee77a8827a1446220fa07ee693dc4d9a29a578

Timeline

2026-10-22: disclosed
other: Vulnerability reported via GitHub issue #11 on 2026-10-09; project maintainer has not responded

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.