CVE-2026-96548
MediumCVSS 5.6Summary
In sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8, a flaw exists in an unknown part of the file ssm_pro/src/main/resources/jdbc.properties, causing hard-coded credentials. The attack can be initiated remotely, its complexity is rated high, and exploitability is indicated as difficult. The exploit has been published and may be used. This product uses a rolling release for continuous delivery, so no version details for affected or updated releases are available. The project was informed early via an issue report but has not responded.
Risk Assessment
Hard-coded credentials in a configuration file may enable unauthorized access to the database or other resources if the file leaks or is read. Despite high attack complexity, a publicly available exploit increases the risk of exploitation.
Recommendation
Remove hard-coded credentials from jdbc.properties and replace them with a secure secrets-management mechanism. Since the project has not responded, consider applying your own fix or restricting file access and rotating any exposed credentials.
Other vulnerabilities in sfturing hosp_order
See all- CVE-2026-96551Medium
A vulnerability was found in the sfturing hosp_order project in an unknown function of ssm_pro/src/main/java/cn/sfturing/web/CommonUserController.java. Manipulation leads to cross-site request forgery, and the attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
- CVE-2026-95396Medium
A vulnerability was identified in sfturing hosp_order up to commit 627f426331da8086ce8fff2017d65b1ddef384f8. An unknown function in HospitalController.java of the Public Search Handlers component is affected. Manipulation of the Search argument leads to cross-site scripting. The attack can be initiated remotely, and the exploit is publicly available. The project has not responded.
- CVE-2026-86260Medium
A security flaw was discovered in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. The affected function is modifyPassWord in the file ssm_pro/src/main/java/cn/sfturing/web/CommonUserController.java (Password Recovery component). Manipulation results in unverified password change. Remote exploitation is possible, and the exploit has been released publicly. The project has not responded yet.
Original NVD description (English source)
A flaw has been found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. This affects an unknown part of the file ssm_pro/src/main/resources/jdbc.properties. This manipulation causes hard-coded credentials. It is possible to initiate the attack remotely. The attack's complexity is rated as high. It is indicated that the exploitability is difficult. The exploit has been published and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.