PT-2026-41944 · Unknown · Lalanachami Pharmacy Management System

Published 2026-05-19 · Updated 2026-05-20 · CVE-2026-31071

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions LalanaChami Pharmacy Management System version 5c3d028

Description Certain API endpoints lack authentication middleware, allowing unauthenticated remote attackers to access sensitive data and perform unauthorized actions. Specifically, the '/api/user/getUserData' endpoint can be used to dump all user records, including bcrypt password hashes. Additionally, attackers can modify drug inventory and access private medical prescription data through the '/api/doctorOder' endpoint.

Recommendations Implement authentication middleware for the '/api/user/getUserData' and '/api/doctorOder' endpoints to prevent unauthorized access.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-31071

Affected Products

Lalanachami Pharmacy Management System

References · 4

• 🔥 https://gist.github.com/nedlir/bc8ad4693c53256819280e8f5de49286 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-31071 · Security Note
• https://github.com/LalanaChami/Pharmacy-Mangment-System/tree/5c3d02888631166649856f71d542387114b3010b/backend/routes · Note
• https://twitter.com/CVEnew/status/2056994221127848043 · Twitter Post