CVE-2026-15477

MEDIUM

Bahmni bahmnicore Search Endpoint sql additionalParams sql injection

Title source: cna
STIX 2.1

Description

A vulnerability was detected in Bahmni bahmnicore up to 0.93. This affects the function additionalParams of the file /openmrs/ws/rest/v1/bahmnicore/sql of the component Search Endpoint. Performing a manipulation of the argument test results in sql injection. The attack can be initiated remotely. The exploit is now public and may be used. Upgrading to version 0.93.1, 1.0.1, 1.1.1, 1.2.1, 1.3.1 and 2.0.1 mitigates this issue. Upgrading the affected component is recommended.

References (6)

Core 6
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-377782 | Bahmni bahmnicore Search Endpoint sql additionalParams sql injection
https://vuldb.com/vuln/377782
Signature, Permissions Required signature permissions-required
VDB-377782 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/377782/cti
Third Party Advisory third-party-advisory
CVE-2026-15477 | CVE Analysis and Report
https://vuldb.com/cve/CVE-2026-15477
Third Party Advisory third-party-advisory
Submit #836079 | Bahmni bahmni-core 1.3.0 SQL Injection
https://vuldb.com/submit/836079

Scores

CVSS v3 6.3
EPSS 0.0021
EPSS Percentile 10.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-74 CWE-89
Status published
Products (50)
Bahmni/bahmnicore 0.1
Bahmni/bahmnicore 0.10
Bahmni/bahmnicore 0.11
Bahmni/bahmnicore 0.12
Bahmni/bahmnicore 0.13
Bahmni/bahmnicore 0.14
Bahmni/bahmnicore 0.15
Bahmni/bahmnicore 0.16
Bahmni/bahmnicore 0.17
Bahmni/bahmnicore 0.18
... and 40 more
Published Jul 12, 2026
Tracked Since Jul 12, 2026