These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A vulnerability was found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. This issue affects the function getProperties of the file ssm_pro/src/main/java/cn/sfturing/utils/MailUtil.java. Performing a manipulation results in cleartext transmission of sensitive information. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitability is assessed [truncated]
A vulnerability was identified in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. Affected is an unknown function of the file HospitalController.java of the component Public Search Handlers. The manipulation of the argument Search leads to cross site scripting. The attack can be initiated remotely. This vulnerability has a significant impact on the security of affected systems, as it a [truncated]
A vulnerability was detected in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. This impacts the function orderRecordsService.cancelOrder of the file ssm_pro/src/main/java/cn/sfturing/web/OrderController.java of the component Order Cancellation. The manipulation of the argument ID results in authorization bypass. The attack may be performed from remote. The exploit is now public and may be used.
A security vulnerability has been detected in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. This affects the function updateOrderSta1/updateOrderdiseaseInfo of the file ssm_pro/src/main/java/cn/sfturing/web/OrderController.java of the component Order Handler. The manipulation of the argument userID/id leads to authorization bypass. The attack is possible to be carried out remotely. T [truncated]
A weakness in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8 allows for authorization bypass via manipulation of the userIdenf argument in OrderController.java. The attack can be executed remotely. A public exploit is available. This product uses a rolling release, so version information for affected or updated releases is unavailable.
CVE-2026-86260 is a security flaw in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8, specifically in the modifyPassWord function of CommonUserController.java, allowing unverified password changes. Remote exploitation is possible. The project follows a rolling release approach, so version details for affected or updated releases are not provided.
A vulnerability was identified in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. The function findOrderHosNum in the file /ssm_pro/orderHos/ is affected by a SQL injection vulnerability through manipulation of the hospitalAddress and hospitalName arguments. This issue can be exploited remotely, and a public exploit is available. However, the product does not use versioning, making it [truncated]