CVE-2026-115248

mediumpriority · track · 22EPSS 0.003 · 15 %ile

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.25% (15th) EPSS

CVSS 5.4 · medium

Is it mine?

0 products

Check your exposure

Who says so?

— sources

EPSS · scored 2026-10-23

A vulnerability was detected in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This issue affects some unknown processing of the file patappointtime.php of the component Booking Handler. The manipulation results in enforcement of behavioral workflow. It is possible to launch the attack remotely. The exploit is now public and may be used. The patch is identified as e9ee77a8827a1446220fa07ee693dc4d9a29a578. It is advisable to implement a patch to correct this issue. The project was informed of the problem early through an issue report but has not responded yet.

cvss

Technical severity, 0–10. One row per scoring source.

5.5

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 1.3–5.5

v3.15.4mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:Lprimary · cna@vuldb.comexploitability 2.8 · impact 2.5

v2.05.5mediumAV:N/AC:L/Au:S/C:N/I:P/A:Psecondary · cna@vuldb.comexploitability 8 · impact 4.9

v4.02.1lowCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · cna@vuldb.com

v4.01.3lowCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-840USprimaryCWE-841USprimary

affected products

Products and version ranges known to be affected.

No affected products recorded.

sources

Which sources assert this record, and when.

NVD CVE.org MITRE

published 2026-10-22modified 2026-10-22

related (225)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2026-67279US	medium6.5OT critical	1.05% (64th)	KEV	2026-09-05
RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session…
CVE-2021-1871US	critical9.8OT critical	7.00% (94th)	KEV	2021-04-02
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, iOS 14.4 and…
CVE-2020-9850US	critical9.8	77.4% (100th)	Exploit	2020-06-09
A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.5 and iPadOS 13.5, tvOS 13.4.5, watchOS 6.2.5, Safari 13.1.1, iTunes 12.10.7 for Windows, iClo…
CVE-2014-0224US	high7.4	95.3% (100th)	Exploit	2014-06-05
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to…
CVE-2006-2370US	high7.5	70.1% (99th)	Exploit	2006-06-13
Buffer overflow in the Routing and Remote Access service (RRAS) in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows remote unauthenticated or auth…

+220 more

references (6) nvd

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan