Le-yan｜Medical Practice Management System - Remote Code Execution

Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Affected scope and exposure questions

The current feed maps Le-yan/Medical Practice Management System (generic). Check affected ranges and fixed versions before updating.

Recommended response

1. 1Check inventory. Check lockfiles and deployed manifests for Le-yan/Medical Practice Management System.
2. 2Review the reported fix. Monitor this advisory for an available fix and review any installs of the affected package.

Evidence timeline and material changes

1. Published upstream

   Aug 25, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

2. Source modified

   Aug 25, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

3. First seen by HOL

   Aug 25, 2026

Sources and claim methodology

• Source referencetwcert.org.tw
• Source referencetwcert.org.tw

Related CVEs

• Password Protect WordPress Lite <= 1.9.21 - Authenticated (Contributor+) Stored Cross-Site ScriptingSame generic ecosystem
• Events Manager <= 7.4.0 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'status', 'private', and 'private_only' ParametersSame generic ecosystem
• WP Courses LMS <= 3.2.29 - Insecure Direct Object Reference to Authenticated (Custom+) Sensitive Information Disclosure via 'resultID' ParameterSame generic ecosystem
• Events Manager <= 7.4.0 - Authenticated (Contributor+) SQL Injection via 'meta_key' Parameter in Event/Location Duplicate ActionSame generic ecosystem
• Adminer before 5.5.1 X-Forwarded-Prefix Backslash BypassSame generic ecosystem
• BetterLinks <= 3.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Short URL Creation via create_fbs_link AJAX ActionSame generic ecosystem