Vulnerability · Published Sep 23, 2026 · Assigned by VulDB

CVE-2026-96548sfturing hosp_order jdbc.properties hard-coded credentials

Medium 5.6

In plain English

A medium-severity hard-coded credentials in hosp_order from sfturing. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).

Severity (CVSS 3.1)5.6Medium

Exploit odds (30 days)0.4%top 63.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A flaw has been found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. This affects an unknown part of the file ssm_pro/src/main/resources/jdbc.properties. This manipulation causes hard-coded credentials. It is possible to initiate the attack remotely. The attack's complexity is rated as high. It is indicated that the exploitability is difficult. The exploit has been published and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

Affected products (as reported)

Vendor	Product	Versions
sfturing	hosp_order	627f426331da8086ce8fff2017d65b1ddef384f8

Weakness: CWE-798, CWE-259 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-408950 | sfturing hosp_order jdbc.properties hard-coded credentials vdb-entry
VDB-408950 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-96548 | CVE Analysis and Report third-party-advisory
Submit #907904 | sfturing hosp_order 627f426331da8086ce8fff2017d65b1ddef384f8 Hard-coded Credentials third-party-advisory
https://github.com/sfturing/hosp_order/issues/119 exploit, issue-tracking
https://github.com/sfturing/hosp_order/ product