CVE-2026-86264 Details
Description
A flaw has been found in sfturing ssm_pro up to 627f426331da8086ce8fff2017d65b1ddef384f8. Affected is an unknown function of the file ssm_pro/src/main/java/cn/sfturing/web/OrderController.java of the component Order Endpoint. This manipulation of the argument hospitalName/officesName/doctorName causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
A stored cross-site scripting vulnerability has been identified in the Sfturing application, specifically in the Order Endpoint of the 'ssm_pro' component, up to commit '627f426331da8086ce8fff2017d65b1ddef384f8'. The issue arises because the appointment-creation endpoint allows users to submit hospital, department, and doctor names, which are then stored in the database. Later, these values are rendered directly into HTML on the user-center page without proper encoding. This flaw enables the execution of malicious scripts when the appointment record is viewed.
The recommended fix is to prevent the acceptance of hospital, department, or doctor names from clients. Instead, these should be resolved from validated server-side IDs. Additionally, all values should be encoded at the JSP output stage, including data already stored in the database.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 7, 2026CISA-ADP
Assessed Sep 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/sfturing/hosp_order/issues/117 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://vuldb.com/cve/CVE-2026-86264 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/902243 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/399410 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/399410/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| sfturing hosp_order | 627f426331da8086ce8fff2017d65b1ddef384f8 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 8, 2026 | CVE Modified | CISA-ADP |
| Sep 7, 2026 | New CVE Received | [email protected] |