CVE-2026-42518
Information Disclosure Vulnerability in e-Sushrut HMIS
- State
- Published
- Severity
- 8.7 High
- Published
- Apr 29, 2026
- Updated
- Apr 29, 2026
- Reserved
- Apr 28, 2026
Description
This vulnerability exists in e-Sushrut due to disclosure of sensitive information and hardcoded AES encryption keys in client-side JavaScript. An unauthenticated remote attacker could exploit this vulnerability by accessing the client-side code to extract sensitive information and cryptographic keys.
Successful exploitation of this vulnerability could lead to exposure of sensitive data and compromise of cryptographic protections on the targeted system.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | CERT-In |
Weaknesses
- CWE-321 Use of hard-coded cryptographic key
Affected Products
| Product | Versions |
|---|---|
e-Sushrut, Hospital Management Information System (HMIS)CDAC-Noida |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.