{ "affected": [ { "ranges": [ { "database_specific": { "extracted_events": [ { "introduced": "0.9" }, { "last_affected": "0.9" }, { "introduced": "0.93" }, { "last_affected": "0.93" } ], "source": "AFFECTED_FIELD" }, "events": [ { "introduced": "74a33668784ead3e41ce20c0146f21375ddb9ad2" }, { "last_affected": "74a33668784ead3e41ce20c0146f21375ddb9ad2" } ], "repo": "https://github.com/bahmni/bahmni-core", "type": "GIT" } ], "versions": [ "0.9" ] } ], "aliases": [ "GHSA-cg9w-r5g6-cxq5" ], "database_specific": { "cna_assigner": "VulDB", "cwe_ids": [ "CWE-74", "CWE-89" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15477.json", "unresolved_ranges": [ { "extracted_events": [ { "introduced": "0.1" }, { "last_affected": "0.1" }, { "introduced": "0.2" }, { "last_affected": "0.2" }, { "introduced": "0.3" }, { "last_affected": "0.3" }, { "introduced": "0.4" }, { "last_affected": "0.4" }, { "introduced": "0.5" }, { "last_affected": "0.5" }, { "introduced": "0.6" }, { "last_affected": "0.6" }, { "introduced": "0.7" }, { "last_affected": "0.7" }, { "introduced": "0.8" }, { "last_affected": "0.8" }, { "introduced": "0.10" }, { "last_affected": "0.10" }, { "introduced": "0.11" }, { "last_affected": "0.11" }, { "introduced": "0.12" }, { "last_affected": "0.12" }, { "introduced": "0.13" }, { "last_affected": "0.13" }, { "introduced": "0.14" }, { "last_affected": "0.14" }, { "introduced": "0.15" }, { "last_affected": "0.15" }, { "introduced": "0.16" }, { "last_affected": "0.16" }, { "introduced": "0.17" }, { "last_affected": "0.17" }, { "introduced": "0.18" }, { "last_affected": "0.18" }, { "introduced": "0.19" }, { "last_affected": "0.19" }, { "introduced": "0.20" }, { "last_affected": "0.20" }, { "introduced": "0.21" }, { "last_affected": "0.21" }, { "introduced": "0.22" }, { "last_affected": "0.22" }, { "introduced": "0.23" }, { "last_affected": "0.23" }, { "introduced": "0.24" }, { "last_affected": "0.24" }, { "introduced": "0.25" }, { "last_affected": "0.25" }, { "introduced": "0.26" }, { "last_affected": "0.26" }, { "introduced": "0.27" }, { "last_affected": "0.27" }, { "introduced": "0.28" }, { "last_affected": "0.28" }, { "introduced": "0.29" }, { "last_affected": "0.29" }, { "introduced": "0.30" }, { "last_affected": "0.30" }, { "introduced": "0.31" }, { "last_affected": "0.31" }, { "introduced": "0.32" }, { "last_affected": "0.32" }, { "introduced": "0.33" }, { "last_affected": "0.33" }, { "introduced": "0.34" }, { "last_affected": "0.34" }, { "introduced": "0.35" }, { "last_affected": "0.35" }, { "introduced": "0.36" }, { "last_affected": "0.36" }, { "introduced": "0.37" }, { "last_affected": "0.37" }, { "introduced": "0.38" }, { "last_affected": "0.38" }, { "introduced": "0.39" }, { "last_affected": "0.39" }, { "introduced": "0.40" }, { "last_affected": "0.40" }, { "introduced": "0.41" }, { "last_affected": "0.41" }, { "introduced": "0.42" }, { "last_affected": "0.42" }, { "introduced": "0.43" }, { "last_affected": "0.43" }, { "introduced": "0.44" }, { "last_affected": "0.44" }, { "introduced": "0.45" }, { "last_affected": "0.45" }, { "introduced": "0.46" }, { "last_affected": "0.46" }, { "introduced": "0.47" }, { "last_affected": "0.47" }, { "introduced": "0.48" }, { "last_affected": "0.48" }, { "introduced": "0.49" }, { "last_affected": "0.49" }, { "introduced": "0.50" }, { "last_affected": "0.50" }, { "introduced": "0.51" }, { "last_affected": "0.51" }, { "introduced": "0.52" }, { "last_affected": "0.52" }, { "introduced": "0.53" }, { "last_affected": "0.53" }, { "introduced": "0.54" }, { "last_affected": "0.54" }, { "introduced": "0.55" }, { "last_affected": "0.55" }, { "introduced": "0.56" }, { "last_affected": "0.56" }, { "introduced": "0.57" }, { "last_affected": "0.57" }, { "introduced": "0.58" }, { "last_affected": "0.58" }, { "introduced": "0.59" }, { "last_affected": "0.59" }, { "introduced": "0.60" }, { "last_affected": "0.60" }, { "introduced": "0.61" }, { "last_affected": "0.61" }, { "introduced": "0.62" }, { "last_affected": "0.62" }, { "introduced": "0.63" }, { "last_affected": "0.63" }, { "introduced": "0.64" }, { "last_affected": "0.64" }, { "introduced": "0.65" }, { "last_affected": "0.65" }, { "introduced": "0.66" }, { "last_affected": "0.66" }, { "introduced": "0.67" }, { "last_affected": "0.67" }, { "introduced": "0.68" }, { "last_affected": "0.68" }, { "introduced": "0.69" }, { "last_affected": "0.69" }, { "introduced": "0.70" }, { "last_affected": "0.70" }, { "introduced": "0.71" }, { "last_affected": "0.71" }, { "introduced": "0.72" }, { "last_affected": "0.72" }, { "introduced": "0.73" }, { "last_affected": "0.73" }, { "introduced": "0.74" }, { "last_affected": "0.74" }, { "introduced": "0.75" }, { "last_affected": "0.75" }, { "introduced": "0.76" }, { "last_affected": "0.76" }, { "introduced": "0.77" }, { "last_affected": "0.77" }, { "introduced": "0.78" }, { "last_affected": "0.78" }, { "introduced": "0.79" }, { "last_affected": "0.79" }, { "introduced": "0.80" }, { "last_affected": "0.80" }, { "introduced": "0.81" }, { "last_affected": "0.81" }, { "introduced": "0.82" }, { "last_affected": "0.82" }, { "introduced": "0.83" }, { "last_affected": "0.83" }, { "introduced": "0.84" }, { "last_affected": "0.84" }, { "introduced": "0.85" }, { "last_affected": "0.85" }, { "introduced": "0.86" }, { "last_affected": "0.86" }, { "introduced": "0.87" }, { "last_affected": "0.87" }, { "introduced": "0.88" }, { "last_affected": "0.88" }, { "introduced": "0.89" }, { "last_affected": "0.89" }, { "introduced": "0.90" }, { "last_affected": "0.90" }, { "introduced": "0.91" }, { "last_affected": "0.91" }, { "introduced": "0.92" }, { "last_affected": "0.92" } ], "source": "AFFECTED_FIELD" } ] }, "details": "A vulnerability was detected in Bahmni bahmnicore up to 0.93. This affects the function additionalParams of the file /openmrs/ws/rest/v1/bahmnicore/sql of the component Search Endpoint. Performing a manipulation of the argument test results in sql injection. The attack can be initiated remotely. The exploit is now public and may be used. Upgrading to version 0.93.1, 1.0.1, 1.1.1, 1.2.1, 1.3.1 and 2.0.1 mitigates this issue. Upgrading the affected component is recommended.", "id": "CVE-2026-15477", "modified": "2026-07-16T03:30:49.985287518Z", "published": "2026-07-12T03:45:09.037Z", "references": [ { "type": "ADVISORY", "url": "https://github.com/Bahmni/bahmni-core/security/advisories/GHSA-cg9w-r5g6-cxq5" }, { "type": "ADVISORY", "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15477.json" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15477" }, { "type": "ADVISORY", "url": "https://vuldb.com/cve/CVE-2026-15477" }, { "type": "ADVISORY", "url": "https://vuldb.com/submit/836079" }, { "type": "ADVISORY", "url": "https://vuldb.com/vuln/377782" }, { "type": "REPORT", "url": "https://vuldb.com/vuln/377782/cti" }, { "type": "FIX", "url": "https://bahmni.atlassian.net/wiki/spaces/BAH/pages/5519474693/Bahmni+Security+Patch+July+02+2026+Release+Notes" } ], "schema_version": "1.8.0", "severity": [ { "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "type": "CVSS_V4" } ], "summary": "Bahmni bahmnicore Search Endpoint sql additionalParams sql injection" }