Le-yan MPMS EUVD-2026-67715

Access to the victim's browser history files or server/proxy access logs is the core prerequisite - the attacker does not need to interact with the Medical Practice Management System application directly. On the local device, this requires low-privilege filesystem access to the browser profile directory (e.g., Chrome's History SQLite file, Firefox's places.sqlite) or to server log directories. The CVSS 4.0 vector specifies PR:L, confirming that some level of system privilege is required. What limits exploitation: the attacker cannot exploit this purely over the network without a secondary path to the log or history files; the vulnerability produces read-only confidentiality exposure with no integrity or availability impact; and exploitation is passive - the sensitive URLs must already exist in history or logs from prior legitimate user sessions. The conflict between AV:L in the CVSS vector and 'unauthenticated remote attackers' in the description is unresolved - if log files are network-accessible without authentication, the PR:L and AV:L ratings may understate the realistic attack surface.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) scores 6.8 and characterizes this as a local, low-complexity, low-privilege attack with high confidentiality impact and no integrity or availability consequence. The AV:L metric is notable: it constrains exploitation to an attacker who already has local access to the victim's device or the log storage system, which meaningfully limits the attack surface compared to a purely network-based vulnerability. However, the CVE description states 'unauthenticated remote attackers' can exploit this - a direct conflict with AV:L that should be verified against the vendor advisory; if logs are exposed via a network-accessible interface or shared path without authentication, the effective attack vector may be closer to network-level. No KEV listing and no public exploit code exist at time of analysis, and the EPSS signal is not provided. Despite the moderate CVSS score, the medical context amplifies real-world impact: exposure of patient health information carries regulatory, legal, and reputational consequences under frameworks such as Taiwan's Personal Data Protection Act or HIPAA for any cross-border deployments. This is a meaningful priority for healthcare operators running this software, even absent active exploitation.

A local attacker or insider with low-privilege access to a workstation or shared server where the Medical Practice Management System is accessed could browse the operating system's browser history files or read server/proxy access logs to extract sensitive patient data or session-related parameters embedded in URL query strings. No exploit tooling is required - standard file system access and a text editor or log viewer are sufficient. If server-side access logs are exposed to a network share or a misconfigured log management interface, the effective exploitation could extend to remote attackers without direct device access, consistent with the 'remote attackers' language in the CVE description despite the AV:L CVSS rating.