CVE-2026-86264: Cross Site Scripting in sfturing ssm_pro

This vulnerability affects sfturing ssm_pro up to commit 627f426331da8086ce8fff2017d65b1ddef384f8. It is a cross-site scripting (XSS) flaw caused by improper sanitization or validation of the hospitalName, officesName, or doctorName arguments in the Order Endpoint component (OrderController.java). The vulnerability can be exploited remotely without authentication, and proof-of-concept exploit code is publicly available. The project was notified early but has not provided a response or patch.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability requires user interaction (UI:P) and has low impact on confidentiality and integrity but can affect availability minimally.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should apply temporary mitigations such as input validation and output encoding on the affected parameters (hospitalName, officesName, doctorName) to prevent script injection until an official patch is available.