Paper/Archive/CVE-2026-31071

CVE-2026-31071

mitre — API endpoints in LalanaChami Pharmacy Management System (commit 5c3d028) lack authentication middleware.

CVSS 9.1 (ADP)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 45.7.457 × 209.1 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

API endpoints in LalanaChami Pharmacy Management System (commit 5c3d028) lack authentication middleware. Unauthenticated remote attackers can exploit this to dump all user records (including bcrypt password hashes) via /api/user/getUserData, modify drug inventory, and access private medical prescription data via /api/doctorOder.

Affected

ProductAffectedFixed inSource

n/an/a–CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refgithub.com/LalanaChami/Pharmacy-Mangment-System/tree/5c3d02888631166649856f71d542387114b3010b/backend/routes exploitgist.github.com/nedlir/bc8ad4693c53256819280e8f5de49286