Is CVE-2026-31071 actively exploited?

No active exploitation of CVE-2026-31071 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-31071 be exploited remotely?

Yes. CVE-2026-31071 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-31071?

CVE-2026-31071 has a CVSS score of 9.1 (CRITICAL).

HOME VULNERABILITIESCVE-2026-31071

CRITICAL

CVE-2026-31071

Published: May 19, 2026· Updated: May 20, 2026

9.1

CVSS v3.1

EPSS:0.05%probability of exploitation in 30 daysPercentile:15.3th

Official Description

API endpoints in LalanaChami Pharmacy Management System (commit 5c3d028) lack authentication middleware. Unauthenticated remote attackers can exploit this to dump all user records (including bcrypt password hashes) via /api/user/getUserData, modify drug inventory, and access private medical prescription data via /api/doctorOder.

NVD Source

Risk Analysis

This critical vulnerability in LalanaChami Pharmacy Management System (commit 5c3d028) allows unauthenticated remote attackers to access sensitive data. With a CVSS score of 9.1, this flaw can lead to the exposure of user records, drug inventory modifications, and private medical data.

No public exploit is currently known for this vulnerability. It is remotely exploitable with low attack complexity, making it a significant data breach risk.

Recommended Action

Apply available patches or updates to the LalanaChami Pharmacy Management System. Implement robust authentication middleware for all API endpoints to prevent unauthorized access.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2026-31071 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), with a CVSS base score of 9.1.