CVE-2026-90805
HighCVSS 7.3Summary
A flaw was found in online-clinic-management-system in doctorlogin.php, where manipulation of the doc_mail/doc_pswd arguments leads to SQL injection. The attack can be executed remotely and a public exploit may already be in use. The project was notified but has not responded.
Risk Assessment
An unauthenticated attacker can remotely execute arbitrary SQL queries, risking exposure or modification of patient and staff data. The lack of project response means no official fix is available.
Recommendation
Immediately secure doctorlogin.php by parameterizing SQL queries and validating input, and if possible restrict public access to the application until a fix is released.
Other vulnerabilities in online-clinic-management-system
See all- CVE-2026-90701High
A vulnerability was detected in subhajitkhan online-clinic-management-system in the file listdoctor.php. Manipulation of the searchtext argument leads to SQL injection. The attack may be initiated remotely and the exploit is publicly available.
- CVE-2026-78246High
SQL injection vulnerability in Online Clinic Management System 1.0, in success/login.php, in the Admin Login component. Manipulation of the Username argument leads to SQL injection. Remote exploitation is possible.
Original NVD description (English source)
A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This affects an unknown part of the file doctorlogin.php. Executing a manipulation of the argument doc_mail/doc_pswd can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.