Clinic's Patient Management System v1.0 has arbitrary code execution via url: ip/pms/users.php.
NVD-CWE-noinfo