Remote Code Execution Vulnerability in Medical Practice Management System by Le-yan
CVE-2026-78685

8.6HIGH

Key Information:

Vendor

Le-yan

Status
Medical Practice Management System
Vendor
CVE Published:
25 August 2026

What is CVE-2026-78685?

A Remote Code Execution vulnerability exists in the Medical Practice Management System developed by Le-yan. This flaw allows unauthenticated remote attackers to execute arbitrary operating system commands via a specially crafted HTML page. The vulnerability poses significant risks to users, as it can lead to unauthorized access and potential data breaches if exploited. It underscores the necessity for robust security measures and timely updates to safeguard sensitive medical data.

Affected Version(s)

Medical Practice Management System 2.4.2.8 <= 2.5.1.9

References

https://www.twcert.org.tw/tw/cp-132-11127-cda76-1.html
third-party-advisory
https://www.twcert.org.tw/en/cp-139-11128-8bd30-2.html
third-party-advisory

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.