CVE-2026-96550 Details
Description
A vulnerability was found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. This issue affects the function getProperties of the file ssm_pro/src/main/java/cn/sfturing/utils/MailUtil.java. Performing a manipulation results in cleartext transmission of sensitive information. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitability is assessed as difficult. The exploit has been made public and could be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
A vulnerability exists in the Sfturing Hosp_Order project, specifically in the Mail Utility component, within the function 'getProperties' of the file 'MailUtil.java'. This vulnerability allows for cleartext transmission of sensitive information, such as mail account passwords and password reset codes, over SMTP without the protection of TLS or STARTTLS. The issue can be exploited remotely, but the complexity of the attack is considered high.
To address this vulnerability, it is recommended to require TLS before authentication, configure a TLS-capable submission endpoint, enable and require STARTTLS or implicit TLS, validate the server certificate and hostname, and rotate the existing SMTP password.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/sfturing/hosp_order/ | [email protected] | ProductVendor |
| https://github.com/sfturing/hosp_order/issues/121 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://vuldb.com/cve/CVE-2026-96550 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/907906 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/408952 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/408952/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-310 | Cryptographic Issues | [email protected] |
| CWE-319 | Cleartext Transmission of Sensitive Information | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| sfturing hosp_order | 627f426331da8086ce8fff2017d65b1ddef384f8 |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 23, 2026 | New CVE Received | [email protected] |