CVE-2026-86264: sfturing ssm_pro Order Endpoint OrderController.java cross site scripting
A flaw has been found in sfturing ssmpro up to 627f426331da8086ce8fff2017d65b1ddef384f8. Affected is an unknown function of the file ssmpro/src/main/java/cn/sfturing/web/OrderController.java of the component Order Endpoint. This manipulation of the argument hospitalName/officesName/doctorName causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What input fields are involved in the cross-site scripting issue?
The affected Order Endpoint accepts the hospitalName, officesName, and doctorName arguments. Manipulation of these arguments can cause cross-site scripting in OrderController.java.
Can this be exploited remotely without authentication?
Yes. The vulnerability is remotely exploitable, and the supplied vector indicates no privileges are required. Exploitation does require user interaction.
Which releases are known to be affected?
sfturing ssm_pro is affected through commit 627f426331da8086ce8fff2017d65b1ddef384f8. No fixed version is identified in the available information.
Is exploit code available?
Yes. An exploit has been published and may be used.
Is a vendor fix available?
The project was notified through an issue report but had not responded at the time of the report. The available information does not identify a patch or workaround.