CVE-2026-86262

In sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8, the MD5.getMD5 function in MD5.java uses a one-way hash without salt for user password handling. The attack can be initiated remotely, though it requires high complexity and is assessed as difficult.

In sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8, the getProperties function in MailUtil.java results in cleartext transmission of sensitive information. The attack can be initiated remotely, though it requires high complexity and is assessed as difficult.

In sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8, unknown code in CommonUserServiceImpl.java leads to cleartext storage of sensitive information. The attack can only be performed locally, and the exploit has been publicly disclosed.

Authorization bypass vulnerability in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8, affecting the orderRecordsService.cancelOrder function in OrderController.java. Manipulating the ID argument allows remote authorization bypass. The exploit is public.

Authorization bypass vulnerability in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8, affecting an unknown function in OrderController.java. Manipulating the userIdenf argument leads to remote authorization bypass. The exploit is public.

A vulnerability was identified in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. Affected by this vulnerability is the function findOrderHosNum of the file /ssm_pro/orderHos/. Such manipulation of the argument hospitalAddress/hospitalName leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way.