# CVE-2026-95396: sfturing hosp_order reflected XSS in public search parameters

Source: https://junglewise.ai/threats/cve-2026-95396-a-vulnerability-was-identified-in-sfturing-hosp-order-up-to  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-22. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-95396 · Severity: medium · CVSS 4.3 · Published 2026-09-22

sfturing hosp_order is a hospital appointment booking system written in Java. A reflected cross-site scripting vulnerability in public search pages allows an attacker to craft malicious URLs that execute JavaScript in a user's browser when visited. An attacker can steal session data, modify displayed appointment information, or perform unauthorized actions on behalf of the user without requiring authentication.

Technologies: [Sfturing Hosp Order](https://junglewise.ai/threats/technologies/hosp-order). Vendors: [Sfturing](https://junglewise.ai/threats/vendors/sfturing).

## Quick answers

**Is CVE-2026-95396 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-95396 being exploited in the wild.

**How severe is CVE-2026-95396?** Medium severity, with a CVSS score of 4.3, published 22 September 2026.

**Which products and versions are affected?** Sfturing Hosp Order up to commit 627f426331da8086ce8fff2017d65b1ddef384f8.

**Is there a fix for CVE-2026-95396?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-95396 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-95396?** Check whether you run Sfturing Hosp Order at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in HospitalController, DoctorController, and OfficeController which copy HTTP request parameters into JSP templates without HTML encoding. JSP pages render these values directly in input element attributes using unescaped expression language (${commonCondition.hospitalName}), allowing attribute injection with event handler payloads. The attack requires no authentication or user interaction beyond opening a crafted URL, and exploits the application's origin to access session data and perform same-origin requests.

## Affected products

- sfturing hosp_order up to commit 627f426331da8086ce8fff2017d65b1ddef384f8

## Timeline

- 2026-07-22: disclosed
- 2026-09-22: advisory

## References

- [https://github.com/sfturing/hosp_order/](https://github.com/sfturing/hosp_order/)
- [https://github.com/sfturing/hosp_order/issues/118](https://github.com/sfturing/hosp_order/issues/118)

## Related threats

- [sfturing hosp_order CSRF in user profile modification endpoints](https://junglewise.ai/threats/cve-2026-96551-a-vulnerability-was-determined-in-sfturing-hosp-order-up-to)
- [sfturing hosp_order hard-coded credentials in configuration](https://junglewise.ai/threats/cve-2026-96548-a-flaw-has-been-found-in-sfturing-hosp-order-up-to)
- [sfturing hosp_order authorization bypass in order cancellation](https://junglewise.ai/threats/cve-2026-86263-sfturing-hosp-order-authorization-bypass-in-order-cancellation)
- [sfturing hosp_order authorization bypass in Order Handler](https://junglewise.ai/threats/cve-2026-86262-sfturing-hosp-order-authorization-bypass-in-order-handler)
- [sfturing hosp_order authorization bypass in Order Controller](https://junglewise.ai/threats/cve-2026-86261-sfturing-hosp-order-authorization-bypass-in-order-controller)