CVE-2026-31071
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
API endpoints in LalanaChami Pharmacy Management System (commit 5c3d028) lack authentication middleware. Unauthenticated remote attackers can exploit this to dump all user records (including bcrypt password hashes) via /api/user/getUserData, modify drug inventory, and access private medical prescription data via /api/doctorOder.
Risk Assessment
An attacker can access sensitive user data, including passwords, and modify medical data, posing a serious privacy and integrity risk.
Recommendation
Add authentication middleware to all API endpoints in the LalanaChami Pharmacy Management System.
Original NVD description (English source)
API endpoints in LalanaChami Pharmacy Management System (commit 5c3d028) lack authentication middleware. Unauthenticated remote attackers can exploit this to dump all user records (including bcrypt password hashes) via /api/user/getUserData, modify drug inventory, and access private medical prescription data via /api/doctorOder.