CVE-2026-82181: CWE-598 Use of GET request method with sensitive query strings in Le-yan Medical Practice Management System

The Le-yan Medical Practice Management System version 2.4.2.8 contains a CWE-598 vulnerability where sensitive data is transmitted via the URL using the GET request method. This design flaw allows unauthenticated remote attackers to potentially access sensitive information through the victim's browser history or server log files. The vulnerability does not require user interaction or privileges beyond low-level access and has a CVSS 4.0 base score of 6.8, indicating medium severity. No official patch or remediation guidance has been provided by the vendor as of the publication date.

Sensitive information may be exposed to unauthorized parties through browser history or log files, potentially leading to privacy violations or data leakage. However, exploitation requires local access to these logs or the victim's device/browser history, limiting the attack vector to scenarios where such access is feasible.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid transmitting sensitive data via GET request query strings. Limit access to browser histories and log files to trusted users only.