CVE-2025-6768: falha de média gravidade em sfturing hosp_order
sfturing hosp_order HospitalServiceImpl.java findAllHosByCondition sql injection
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.3%
A vulnerability classified as critical has been found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. Affected is the function findAllHosByCondition of the file HospitalServiceImpl.java. The manipulation of the argument hospitalName leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Produtos afetados
sfturing · hosp_orderCVEs relacionadas — sfturing hosp_order
No mesmo produto, das mais perigosas para as menos.
CVE-2026-86260MEDIUMsfturing hosp_order Password Recovery CommonUserController.java modifyPassWord unverified password changeEPSS 0.6%CVE-2026-86263MEDIUMsfturing hosp_order Order Cancellation OrderController.java orderRecordsService.cancelOrder authorizationEPSS 0.6%CVE-2026-86262MEDIUMsfturing hosp_order Order OrderController.java updateOrderdiseaseInfo authorizationEPSS 0.6%CVE-2026-86261MEDIUMsfturing hosp_order Order Controller OrderController.java authorizationEPSS 0.6%CVE-2026-95396MEDIUMsfturing hosp_order Public Search Handlers HospitalController.java cross site scriptingEPSS 0.5%CVE-2026-96548MEDIUMsfturing hosp_order jdbc.properties hard-coded credentialsEPSS 0.4%