CVE-2024-46532: Kancloud Openhis

Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days.

SQL Injection vulnerability in OpenHIS v.1.0 allows an attacker to execute arbitrary code via the refund function in the PayController.class.php component.

Affected products

• Kancloud Openhis: version 1.0 only

Published 2024-10-11. Last modified 2026-07-05.