CVE-2026-42518
HighSummary
This vulnerability in e-Sushrut is due to disclosure of sensitive information and hardcoded AES encryption keys in client-side JavaScript.
Risk Assessment
An unauthenticated remote attacker can exploit this by accessing client-side code, leading to exposure of sensitive data and compromise of cryptographic protections.
Recommendation
Remove sensitive data and keys from client-side code, move them to the server, and apply proper protection mechanisms.
Other vulnerabilities in e-Sushrut
See all- CVE-2026-42517High
This vulnerability in e-Sushrut is due to the use of reversible Base64 encoding for protecting sensitive data.
- CVE-2026-42516High
This vulnerability in e-Sushrut is due to improper authorization checks during resource access.
- CVE-2026-42515High
This vulnerability in e-Sushrut is due to improper access control in resource access validation.
- CVE-2026-42514High
This vulnerability in e-Sushrut is due to exposure of OTPs in plaintext within API responses.
- CVE-2026-42513High
This vulnerability in e-Sushrut is due to improper authentication logic that relies on client-side response parameters to determine authentication status.
Original NVD description (English source)
This vulnerability exists in e-Sushrut due to disclosure of sensitive information and hardcoded AES encryption keys in client-side JavaScript. An unauthenticated remote attacker could exploit this vulnerability by accessing the client-side code to extract sensitive information and cryptographic keys. Successful exploitation of this vulnerability could lead to exposure of sensitive data and compromise of cryptographic protections on the targeted system.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS