Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-86264: sfturing ssm_pro Order Endpoint allows remote script injection

CVE-2026-86264 · published 1 month ago

Summary

The Order page in sfturing ssm_pro does not properly check the values for hospital, office or doctor names. An attacker can supply malicious code that runs in a user’s browser, potentially stealing information or altering the displayed page. Apply the vendor’s update or filter user inputs to block script characters as soon as possible.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
sfturing	ssm_pro	627f426331da8086ce8fff2017d65b1ddef384f8

Original advisory text

sfturing ssm_pro Order Endpoint OrderController.java cross site scripting

A flaw has been found in sfturing ssm_pro up to 627f426331da8086ce8fff2017d65b1ddef384f8. Affected is an unknown function of the file ssm_pro/src/main/java/cn/sfturing/web/OrderController.java of the component Order Endpoint. This manipulation of the argument hospitalName/officesName/doctorName causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

References

https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86264... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-86264 Vendor Advisory
https://github.com/sfturing/hosp_order/issues/117 Third Party Advisory
https://vuldb.com/cve/CVE-2026-86264 Vendor Advisory
https://vuldb.com/submit/902243 Vendor Advisory
https://vuldb.com/vuln/399410 Vendor Advisory
https://vuldb.com/vuln/399410/cti Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

7.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

CWE-94Code Injection

Timeline

Published7 Sep 2026

Updated4 Nov 2026

First seen8 Sep 2026

Sources

CVE-2026-86264 · NVD

CVE-2026-86264 · MITRE

CVE-2026-86264 · OSV

Track software like this

Free during beta