CVE-2026-31071

Critical severity, CVSS 9.1. EPSS: 0.7% chance of exploitation in the next 30 days.

API endpoints in LalanaChami Pharmacy Management System (commit 5c3d028) lack authentication middleware. Unauthenticated remote attackers can exploit this to dump all user records (including bcrypt password hashes) via /api/user/getUserData, modify drug inventory, and access private medical prescription data via /api/doctorOder.

Published 2026-05-19. Last modified 2026-07-24.