EUVD-2026-65270
GHSA-79cf-7rfq-5q6f
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered, low-complexity attack requiring no attacker privileges but mandatory victim interaction per CWE-940 CSRF pattern; no scope change; full CIA impact from arbitrary OS command execution.
Primary rating from Vendor (twcert).
CVSS VectorVendor: twcert
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
5DescriptionCVE.org
Medical Practice Management System developed by Le-yan has a Remote Code Execution vulnerability. Unauthenticated remote attackers can execute arbitrary OS commamnds via a crafted HTML page.
AnalysisAI
Remote code execution in Le-yan's Medical Practice Management System allows unauthenticated remote attackers to execute arbitrary OS commands on the server by inducing a user to visit a crafted HTML page. The root cause is CWE-940 (Improper Verification of Source of a Communication Channel), indicating the application processes incoming requests without validating their origin - a pattern consistent with CSRF-driven command injection where the server's trust of unverified channels is the enabling weakness. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that a user with an active or credentialed session on the Le-yan Medical Practice Management System open an attacker-crafted HTML page in their browser; the CVSS 4.0 UI:A metric confirms this interaction is mandatory and the attack cannot be automated against passive targets. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 8.6 (AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H) reflects high severity with complete compromise of the vulnerable system achievable. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers a domain and hosts a webpage containing crafted HTML or JavaScript that, when loaded by a user with an active Le-yan MPMS session, silently submits a malformed request to the MPMS server. Because the server does not verify the origin of the communication channel (CWE-940), it treats the cross-origin request as legitimate and executes the embedded OS command payload with the application's process privileges. … |
| Remediation | No specific patched version has been identified from the TWCERT advisories (https://www.twcert.org.tw/en/cp-139-11128-8bd30-2.html); contact Le-yan directly to obtain a patched release and apply it immediately upon availability. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all instances of Le-yan Medical Practice Management System in your environment and implement immediate network segmentation to restrict both inbound and outbound connections to essential operational channels only; enable enhanced logging of all process execution and network activity for forensic review. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today