CVE-2026-96549: sfturing hosp_order CommonUserServiceImpl.java cleartext storage
A vulnerability has been found in sfturing hosporder up to 627f426331da8086ce8fff2017d65b1ddef384f8. This vulnerability affects unknown code of the file ssmpro/src/main/java/cn/sfturing/service/impl/CommonUserServiceImpl.java. Such manipulation leads to cleartext storage of sensitive information. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems are exposed only to attackers operating from a local environment who have low-level privileges. Remote-only attackers cannot exploit the issue based on the available information.
What makes exploitation more likely?
A public exploit has been disclosed and may be used. Exploitation does not require user interaction, but it does require local access and low privileges.
How can I determine whether my deployment may be affected?
Review whether your hosp_order source includes ssm_pro/src/main/java/cn/sfturing/service/impl/CommonUserServiceImpl.java and is at or before revision 627f426331da8086ce8fff2017d65b1ddef384f8. Because the project uses rolling releases, affected and updated release version details are not available.
Is a vendor fix available?
No updated release information is available. The project was reportedly notified through an issue report but had not responded at the time of publication.