CVE-2026-8031

MediumCVSS 5.3

Published: 06/05/2026(UTC)Updated: 26/10/2026(UTC)Translated: 26/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.39%

33th percentile - higher than 33% of all known CVEs

Summary

In PicoTronica e-Clinic Healthcare System ECHS 5.7, the file /cdemos/echs/api/v2/patient-records (API Endpoint component) contains an unknown function with missing authentication. The attack can be executed remotely, and the exploit is publicly available and may be used. Upgrading to version 5.7.1 is sufficient to fix the issue.

Risk Assessment

Missing authentication on the API endpoint may allow unauthorized access to patient data, posing a serious confidentiality and compliance risk. The risk affects organizations using ECHS 5.7.

Recommendation

Upgrade PicoTronica e-Clinic Healthcare System ECHS to version 5.7.1 or later. Until patched, consider restricting network access to the API endpoint.

Other vulnerabilities in PicoTronica e-Clinic Healthcare System ECHS

CVE-2026-8033Medium
A vulnerability in PicoTronica e-Clinic Healthcare System ECHS 5.7 in the file /cdemos/echs/api/v2/ leads to information disclosure. The attack can be performed remotely, and the exploit has been publicly disclosed.

Original NVD description (English source)

A vulnerability was detected in PicoTronica e-Clinic Healthcare System ECHS 5.7. The affected element is an unknown function of the file /cdemos/echs/api/v2/patient-records of the component API Endpoint. The manipulation results in missing authentication. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version 5.7.1 is sufficient to fix this issue. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS