CVE-2026-96552

What it is

A vulnerability was identified in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. The affected element is the function MD5.getMD5 of the file ssm_pro/src/main/java/cn/sfturing/utils/MD5.java of the component User Password Handler. The manipulation leads to one-way hash without salt. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is described as difficult. The exploit is publicly available and might be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.

At a glance

Exploitability

Can be exploited over the network with a low-privilege account. Limited direct impact.

Exploit odds

0.2% chance of exploitation in the next 30 days (EPSS).

Fix

No patch or advisory is linked yet. Look at mitigations or restrict exposure.

Timeline

1. 2026-09-23 20:17 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-09-24 16:17 UTC Last updatedMost recent change to the record

Details

Published

2026-09-23 20:17 UTC

Last modified

2026-09-24 16:17 UTC

Exploit probability

0.2% · EPSS, next 30 days

Weakness

CWE-325

Record status

Deferred

Attack profile CVSS 4.0 · 1.3

Attack vector

Network

Complexity

High

Attack requirements

None

Privileges needed

Low

User interaction

None

Confidentiality

Low

Integrity

None

Availability

None