Reference page — cumulative record through Saturday, October 3, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N H N L N L N N 1.3 .0015 3.6 —
AFFECTED Product Versions Fixed hosp_order 627f426331da8086ce8fff2017d65b1ddef384f8 – —
TIMELINE Sep 23 Reserved by VulDB Sep 23 Published (CNA: VulDB) Sep 24 EXPLOIT PUBLISHED — CVE-2026-96552 (sfturing hosp_order). Public exploit reference added.
A vulnerability was identified in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. The affected element is the function MD5.getMD5 of the file ssm_pro/src/main/java/cn/sfturing/utils/MD5.java of the component User Password Handler. The manipulation leads to one-way hash without salt. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is described as difficult. The exploit is publicly available and might be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
| Date | Event | Detail |
|---|---|---|
| September 23, 2026 | Reserved | Reserved by VulDB |
| September 23, 2026 | Published | Published (CNA: VulDB) |
| September 24, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-96552 (sfturing hosp_order). Public exploit reference added. |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| sfturing | hosp_order | — | 627f426331da8086ce8fff2017d65b1ddef384f8 | — |
Authoritative record: CVE-2026-96552 at cve.org
Vendors: sfturing
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-96552 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Saturday, October 3, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
