CVSS 3.1
Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)
Атакува се
Време до експлоатация
Атакува се по мрежата, без особени условия, без вход и без действие от потребителя.
- Експлоатация: има публичен пример за експлоатация
- Атаката може да се автоматизира
Описание
Оригинално описание
A weakness has been identified in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. The impacted element is an unknown function of the file ssm_pro/src/main/java/cn/sfturing/web/OrderController.java of the component Order Controller. Executing a manipulation of the argument userIdenf can lead to authorization bypass. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Засегнати продукти
- sfturing hosp_order: 627f426331da8086ce8fff2017d65b1ddef384f8
Вид слабост
История
- 7 септември 2026 Публикувано
Други уязвимости в sfturing hosp_order
Първоизточници
- https://www.cve.org/CVERecord?id=CVE-2026-86261
- https://nvd.nist.gov/vuln/detail/CVE-2026-86261
- https://vuldb.com/vuln/399407
- https://vuldb.com/vuln/399407/cti
- https://vuldb.com/cve/CVE-2026-86261
- https://vuldb.com/submit/902240
- https://github.com/sfturing/hosp_order/issues/114
- https://github.com/sfturing/hosp_order/