CVE-2026-96551
MediumCVSS 4.3Summary
A vulnerability was found in the sfturing hosp_order project in an unknown function of ssm_pro/src/main/java/cn/sfturing/web/CommonUserController.java. Manipulation leads to cross-site request forgery, and the attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
Risk Assessment
A remote attacker can force an authenticated user to perform unwanted actions. Public exploit disclosure increases the likelihood of exploitation.
Recommendation
Apply CSRF protections (tokens, header verification) in the affected controller. Since the project does not use versioning, contact the project maintainer for a fix.
Other vulnerabilities in sfturing hosp_order
See all- CVE-2026-96548Medium
In sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8, a flaw exists in an unknown part of the file ssm_pro/src/main/resources/jdbc.properties, causing hard-coded credentials. The attack can be initiated remotely, its complexity is rated high, and exploitability is indicated as difficult. The exploit has been published and may be used. This product uses a rolling release for continuous delivery, so no version details for affected or updated releases are available. The project was informed early via an issue report but has not responded.
- CVE-2026-95396Medium
A vulnerability was identified in sfturing hosp_order up to commit 627f426331da8086ce8fff2017d65b1ddef384f8. An unknown function in HospitalController.java of the Public Search Handlers component is affected. Manipulation of the Search argument leads to cross-site scripting. The attack can be initiated remotely, and the exploit is publicly available. The project has not responded.
- CVE-2026-86260Medium
A security flaw was discovered in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. The affected function is modifyPassWord in the file ssm_pro/src/main/java/cn/sfturing/web/CommonUserController.java (Password Recovery component). Manipulation results in unverified password change. Remote exploitation is possible, and the exploit has been released publicly. The project has not responded yet.
Original NVD description (English source)
A vulnerability was determined in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. Impacted is an unknown function of the file ssm_pro/src/main/java/cn/sfturing/web/CommonUserController.java. Executing a manipulation can lead to cross-site request forgery. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.