CVE-2026-42518
HighSummary
This vulnerability in e-Sushrut is due to disclosure of sensitive information and hardcoded AES encryption keys in client-side JavaScript.
Risk Assessment
An unauthenticated remote attacker can exploit this by accessing client-side code, leading to exposure of sensitive data and compromise of cryptographic protections.
Recommendation
Remove sensitive data and keys from client-side code, move them to the server, and apply proper protection mechanisms.
Other vulnerabilities in e-Sushrut
See all- CVE-2026-42517High
This vulnerability in e-Sushrut is due to the use of reversible Base64 encoding for protecting sensitive data.
- CVE-2026-42516High
This vulnerability in e-Sushrut is due to improper authorization checks during resource access.
- CVE-2026-42515High
This vulnerability in e-Sushrut is due to improper access control in resource access validation.
- CVE-2026-42514High
This vulnerability in e-Sushrut is due to exposure of OTPs in plaintext within API responses.
- CVE-2026-42513High
This vulnerability in e-Sushrut is due to improper authentication logic that relies on client-side response parameters to determine authentication status.
Original NVD description (English source)
This vulnerability exists in e-Sushrut due to disclosure of sensitive information and hardcoded AES encryption keys in client-side JavaScript. An unauthenticated remote attacker could exploit this vulnerability by accessing the client-side code to extract sensitive information and cryptographic keys. Successful exploitation of this vulnerability could lead to exposure of sensitive data and compromise of cryptographic protections on the targeted system.