CVE-2026-90858

HighCVSS 7.3/10Last modified Sep 15, 2026

Description

A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. Affected by this vulnerability is the function session_start of the file adminappview.php. Executing a manipulation of the argument adminmail can lead to authorization bypass. The attack may be launched remotely. The exploit has been published and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-285CWE-639

Affected software

VendorProductVersions
subhajitkhanonline-clinic-management-systeme9ee77a8827a1446220fa07ee693dc4d9a29a578

References

Timeline

Published
Sep 15, 2026
Last modified
Sep 15, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-90867.3A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with `manage-client` permission or accessCVE-2026-908607.1The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned to an external origin running in a privileged WebVieCVE-2026-908616.6Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows may expose a user's password in clear text to another admCVE-2026-908624.3Improper authentication in the Web Transfer Module of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows couCVE-2026-908639.1Missing authorization in the administrative interface of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows CVE-2026-908649.1A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegatedCVE-2026-908659.0An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbiCVE-2026-908669.1A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegatedCVE-2026-908678.1Improper access control in the Web Admin console of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows couldCVE-2026-908689.9An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbiCVE-2026-908697.5A remote attacker who knows a valid account's enrolled SSH public key can terminate the shared SSH service in Progress Software WS_FTP ServeCVE-2026-90878.1A flaw was found in Keycloak. The cross-session verification proof is keyed only by (local userId, idpAlias) and is not bound to the upstrea
CVE-2026-90858: High severity, CVSS 7.3 | Vulnix