Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-90805: Online Clinic Management System doctor login can be hijacked

CVE-2026-90805 · published 1 month ago

Summary

The doctorlogin page of the online-clinic-management-system allows a remote user to tamper with the email and password fields and cause the underlying database to run unwanted commands. This could let an attacker view, change, or delete medical data. Apply the latest updates from the vendor or disable the vulnerable login page until a patch is available.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
subhajitkhan	online-clinic-management-system	e9ee77a8827a1446220fa07ee693dc4d9a29a578

Original advisory text

subhajitkhan online-clinic-management-system doctorlogin.php sql injection

A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This affects an unknown part of the file doctorlogin.php. Executing a manipulation of the argument doc_mail/doc_pswd can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.

References

https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90805... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-90805 Vendor Advisory
https://github.com/subhajitkhan/online-clinic-management-system/issues/3 Third Party Advisory
https://vuldb.com/cve/CVE-2026-90805 Vendor Advisory
https://github.com/subhajitkhan/online-clinic-management-system/ URL
https://vuldb.com/submit/920373 Vendor Advisory
https://vuldb.com/vuln/403307 Vendor Advisory
https://vuldb.com/vuln/403307/cti Third Party Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

8.4 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-89SQL Injection

CWE-74Injection

Timeline

Published14 Sep 2026

Updated4 Nov 2026

First seen14 Sep 2026

Sources

CVE-2026-90805 · NVD

CVE-2026-90805 · MITRE

CVE-2026-90805 · OSV

Track software like this

Free during beta