CVE-2026-95396: sfturing hosp_order Public Search Handlers HospitalController.java cross site scripting
A vulnerability was identified in sfturing hosporder up to 627f426331da8086ce8fff2017d65b1ddef384f8. Affected is an unknown function of the file HospitalController.java of the component Public Search Handlers. The manipulation of the argument Search leads to cross site scripting. The attack can be initiated remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
An attacker can initiate the attack remotely and does not need privileges. Successful exploitation requires user interaction, consistent with the UI:R metric.
Which deployments are potentially affected?
Deployments of sfturing hosp_order containing code up to revision 627f426331da8086ce8fff2017d65b1ddef384f8 are potentially affected. The affected functionality is identified as the Public Search Handlers component in HospitalController.java.
How urgent is remediation?
A public exploit is available and may be used. The reported impact is integrity-only, with no stated confidentiality or availability impact, but the project had not responded to the issue report at the time of publication.