CVE-2024-23747

CVE-2024-23747 Moderna Sistemas ModernaNet 병원 관리 시스템 2024는 안전하지 않은 직접 객체 참조IDOR 취약점에 영향을 받습니다. PoC 이 취약점은 /Modernanet/LAUDO/LAU0000100/Laudo?id= URL을 통한 사용자 데이터 접근 처리에 존재합니다. 이 id 매개변수를 조작함으로써 공격자는 민감한 의료 정보에 접근할 수 있습니다. http://IP/Modernanet/LAUDO/LAU0000100/Laudo?id=NUMBER 결과를 보기 위해 로그인할 필요가 없습니...

CVE-2025-29009

CVE-2025-29009 WordPress Medical Prescription Attachment Plugin for WooCommerce 플러그인 = 1.2.3은 높은 우선순위의 임의 파일 업로드 취약점이 있습니다. CVE-2025-29009 Webkul Medical Prescription Attachment — 제한 없는 파일 업로드 → 웹 셸 root@kitploit: ,-. . , ,--. ,-. ,-. ,-. ;--' ,-. ,-. ,-. ,-. ,-. / | / | / /\ | / /\ / /\ | | / |-...

CVE-2025-29009-POC

CVE-2025-29009-POC Плагин Medical Prescription Attachment для WooCommerce = 1.2.3 - Неаутентифицированная произвольная загрузка файлов. Смотреть демо здесь: https://youtu.be/WvW2shDBIFs...

Astra Linux – Vulnerability in dcmtk

DCMTK through version 3.6.6 does not handle memory deallocation properly. The object in the program is freed, but its address is still used in other locations. Sending specific requests to the dcmqrdb program will lead to a double-free. An attacker can use this vulnerability to launch a DoS attac...

CVE-2026-44715

OpenMRS is an open source electronic medical record system platform. Prior to versions 1.23.0 and 2.10.0, an authenticated user can trigger administrative DWR services. Specifically, the startHl7ArchiveMigration method is accessible, which should be restricted to admin-level accounts. Versions...

CVE-2026-87020

creationtimestamp| type| source ---|---|--- 2026-09-10 16:15:27+00:00| seen| https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-253-02 2026-09-10 20:01:51+00:00| seen| https://bsky.app/profile/cyfar.ca/post/3mv6ts5ifxy2y...

CVE-2026-78224

creationtimestamp| type| source ---|---|--- 2026-09-10 16:05:49+00:00| seen| https://bsky.app/profile/cyfar.ca/post/3mv6gm3rxy52o 2026-09-10 16:15:31+00:00| seen| https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-253-01...

CVE-2026-82578

creationtimestamp| type| source ---|---|--- 2026-09-10 16:05:49+00:00| seen| https://bsky.app/profile/cyfar.ca/post/3mv6gm3rxy52o 2026-09-10 16:15:33+00:00| seen| https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-253-01...

CVE-2026-82583

creationtimestamp| type| source ---|---|--- 2026-09-10 16:05:49+00:00| seen| https://bsky.app/profile/cyfar.ca/post/3mv6gm3rxy52o 2026-09-10 16:15:29+00:00| seen| https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-253-01...

CVE-2026-82181

Medical Practice Management System developed by Le-yan has a Sensitive Data in URL vulnerability. Unauthenticated remote attackers can obtain sensitive information via victim's browser history or log files...

CVE-2026-82181 Le-yan｜Medical Practice Management System - Sensitive Data in URL

Medical Practice Management System developed by Le-yan has a Sensitive Data in URL vulnerability. Unauthenticated remote attackers can obtain sensitive information via victim's browser history or log files...

CVE-2026-78685

Medical Practice Management System developed by Le-yan has a Remote Code Execution vulnerability. Unauthenticated remote attackers can execute arbitrary OS commamnds via a crafted HTML page...

CVE-2026-78685 Le-yan｜Medical Practice Management System - Remote Code Execution

Medical Practice Management System developed by Le-yan has a Remote Code Execution vulnerability. Unauthenticated remote attackers can execute arbitrary OS commamnds via a crafted HTML page...

CVE-2026-78685

CVE-2026-78685 affects the Le-yan Medical Practice Management System , a web-based application for managing medical practices. The vulnerability is a Remote Code Execution (RCE) flaw that allows unauthenticated remote attackers to execute arbitrary OS commands by serving a crafted HTML page that ...

CVE-2026-78685: Improper Verification of Source of a Communication Channel

Medical Practice Management System developed by Le-yan has a Remote Code Execution vulnerability. Unauthenticated remote attackers can execute arbitrary OS commamnds via a crafted HTML page...

CVE-2026-19417

The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user is entitled to the media file being served, allowing authenticated patient-level users to download any file in the media library, including other patients' uploaded medical reports...

CVE-2026-19417

KiviCare WordPress plugin before 4.5.4 serves media files without verifying the requesting user's entitlement, enabling authenticated patient-level users to download any media library file including other patients' medical reports via an IDOR vulnerability; upgrade to 4.5.4. No active exploitatio...

CVE-2026-52723

In ePA 3.x Integration versions prior to 1.3.0, app/vau/VAUProtokoll.py validates the VAU server certificate without anchoring it to independent trusted material, creating a circular trust relationship. Combined with disabled TLS certificate verification, a network-positioned attacker can interce...

CVE-2026-50576

CVE-2026-50576 is a CRLF header injection vulnerability in ePA 3.x Integration , a component of Germany's electronic patient record system. The build_inner_header function in app/vau/VAUProtokoll.py interpolates user-controlled values (uri, host, accept_type, content_type, content_length, USER_AG...

CVE-2026-19785

A vulnerability has been found in francoisjacquet RosarioSIS up to 12.7.4. This vulnerability affects unknown code of the file modules/Students/includes/Medical.inc.php of the component Student Medical Module. Such manipulation of the argument table leads to sql injection. The attack may be...