CVE-2026-96548
Deferred Deferred - Pending Action

Hard-Coded Credentials in Sfturing Hosp Order

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: VulDB

Description
A flaw has been found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. This affects an unknown part of the file ssm_pro/src/main/resources/jdbc.properties. This manipulation causes hard-coded credentials. It is possible to initiate the attack remotely. The attack's complexity is rated as high. It is indicated that the exploitability is difficult. The exploit has been published and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-24
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-96548
EUVD
EUVD-2026-85544

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
sfturing hosp_order *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-798 The product contains hard-coded credentials, such as a password or cryptographic key.
CWE-259 The product contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves hard-coded credentials in the sfturing hosp_order software up to commit 627f426331da8086ce8fff2017d65b1ddef384f8. The issue is located in the jdbc.properties file within the ssm_pro module. Attackers can remotely exploit this flaw due to the exposed credentials, though the attack complexity is rated as high and exploitability is difficult.

Detection Guidance

Detecting hard-coded credentials in jdbc.properties requires inspecting configuration files for exposed passwords or usernames. Search for files named jdbc.properties and review entries for plaintext credentials. Use commands like 'find / -name jdbc.properties 2>/dev/null' to locate the file and 'grep -iE "user|password|credential" /path/to/jdbc.properties' to check for sensitive data.

Impact Analysis

An attacker could gain unauthorized access to systems or data due to the hard-coded credentials. This may lead to data breaches, unauthorized modifications, or service disruptions. The impact depends on the specific use of the affected software in your environment.

Compliance Impact

This vulnerability could violate compliance requirements such as GDPR or HIPAA by exposing sensitive data through unauthorized access. Organizations using this software may face legal penalties, reputational damage, and increased scrutiny from regulators.

Mitigation Strategies

Immediately remove any hard-coded credentials from jdbc.properties and replace them with secure configuration methods like environment variables or secret management tools. Restrict file permissions to prevent unauthorized access. Monitor for suspicious remote access attempts and update the project if a patch becomes available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-96548. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart