{"id":"CVE-2026-15477","summary":"Bahmni bahmnicore Search Endpoint sql additionalParams sql injection","details":"A vulnerability was detected in Bahmni bahmnicore up to 0.93. This affects the function additionalParams of the file /openmrs/ws/rest/v1/bahmnicore/sql of the component Search Endpoint. Performing a manipulation of the argument test results in sql injection. The attack can be initiated remotely. The exploit is now public and may be used. Upgrading to version 0.93.1, 1.0.1, 1.1.1, 1.2.1, 1.3.1 and 2.0.1 mitigates this issue. Upgrading the affected component is recommended.","aliases":["GHSA-cg9w-r5g6-cxq5"],"modified":"2026-07-16T03:30:49.985287518Z","published":"2026-07-12T03:45:09.037Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15477.json","unresolved_ranges":[{"extracted_events":[{"introduced":"0.1"},{"last_affected":"0.1"},{"introduced":"0.2"},{"last_affected":"0.2"},{"introduced":"0.3"},{"last_affected":"0.3"},{"introduced":"0.4"},{"last_affected":"0.4"},{"introduced":"0.5"},{"last_affected":"0.5"},{"introduced":"0.6"},{"last_affected":"0.6"},{"introduced":"0.7"},{"last_affected":"0.7"},{"introduced":"0.8"},{"last_affected":"0.8"},{"introduced":"0.10"},{"last_affected":"0.10"},{"introduced":"0.11"},{"last_affected":"0.11"},{"introduced":"0.12"},{"last_affected":"0.12"},{"introduced":"0.13"},{"last_affected":"0.13"},{"introduced":"0.14"},{"last_affected":"0.14"},{"introduced":"0.15"},{"last_affected":"0.15"},{"introduced":"0.16"},{"last_affected":"0.16"},{"introduced":"0.17"},{"last_affected":"0.17"},{"introduced":"0.18"},{"last_affected":"0.18"},{"introduced":"0.19"},{"last_affected":"0.19"},{"introduced":"0.20"},{"last_affected":"0.20"},{"introduced":"0.21"},{"last_affected":"0.21"},{"introduced":"0.22"},{"last_affected":"0.22"},{"introduced":"0.23"},{"last_affected":"0.23"},{"introduced":"0.24"},{"last_affected":"0.24"},{"introduced":"0.25"},{"last_affected":"0.25"},{"introduced":"0.26"},{"last_affected":"0.26"},{"introduced":"0.27"},{"last_affected":"0.27"},{"introduced":"0.28"},{"last_affected":"0.28"},{"introduced":"0.29"},{"last_affected":"0.29"},{"introduced":"0.30"},{"last_affected":"0.30"},{"introduced":"0.31"},{"last_affected":"0.31"},{"introduced":"0.32"},{"last_affected":"0.32"},{"introduced":"0.33"},{"last_affected":"0.33"},{"introduced":"0.34"},{"last_affected":"0.34"},{"introduced":"0.35"},{"last_affected":"0.35"},{"introduced":"0.36"},{"last_affected":"0.36"},{"introduced":"0.37"},{"last_affected":"0.37"},{"introduced":"0.38"},{"last_affected":"0.38"},{"introduced":"0.39"},{"last_affected":"0.39"},{"introduced":"0.40"},{"last_affected":"0.40"},{"introduced":"0.41"},{"last_affected":"0.41"},{"introduced":"0.42"},{"last_affected":"0.42"},{"introduced":"0.43"},{"last_affected":"0.43"},{"introduced":"0.44"},{"last_affected":"0.44"},{"introduced":"0.45"},{"last_affected":"0.45"},{"introduced":"0.46"},{"last_affected":"0.46"},{"introduced":"0.47"},{"last_affected":"0.47"},{"introduced":"0.48"},{"last_affected":"0.48"},{"introduced":"0.49"},{"last_affected":"0.49"},{"introduced":"0.50"},{"last_affected":"0.50"},{"introduced":"0.51"},{"last_affected":"0.51"},{"introduced":"0.52"},{"last_affected":"0.52"},{"introduced":"0.53"},{"last_affected":"0.53"},{"introduced":"0.54"},{"last_affected":"0.54"},{"introduced":"0.55"},{"last_affected":"0.55"},{"introduced":"0.56"},{"last_affected":"0.56"},{"introduced":"0.57"},{"last_affected":"0.57"},{"introduced":"0.58"},{"last_affected":"0.58"},{"introduced":"0.59"},{"last_affected":"0.59"},{"introduced":"0.60"},{"last_affected":"0.60"},{"introduced":"0.61"},{"last_affected":"0.61"},{"introduced":"0.62"},{"last_affected":"0.62"},{"introduced":"0.63"},{"last_affected":"0.63"},{"introduced":"0.64"},{"last_affected":"0.64"},{"introduced":"0.65"},{"last_affected":"0.65"},{"introduced":"0.66"},{"last_affected":"0.66"},{"introduced":"0.67"},{"last_affected":"0.67"},{"introduced":"0.68"},{"last_affected":"0.68"},{"introduced":"0.69"},{"last_affected":"0.69"},{"introduced":"0.70"},{"last_affected":"0.70"},{"introduced":"0.71"},{"last_affected":"0.71"},{"introduced":"0.72"},{"last_affected":"0.72"},{"introduced":"0.73"},{"last_affected":"0.73"},{"introduced":"0.74"},{"last_affected":"0.74"},{"introduced":"0.75"},{"last_affected":"0.75"},{"introduced":"0.76"},{"last_affected":"0.76"},{"introduced":"0.77"},{"last_affected":"0.77"},{"introduced":"0.78"},{"last_affected":"0.78"},{"introduced":"0.79"},{"last_affected":"0.79"},{"introduced":"0.80"},{"last_affected":"0.80"},{"introduced":"0.81"},{"last_affected":"0.81"},{"introduced":"0.82"},{"last_affected":"0.82"},{"introduced":"0.83"},{"last_affected":"0.83"},{"introduced":"0.84"},{"last_affected":"0.84"},{"introduced":"0.85"},{"last_affected":"0.85"},{"introduced":"0.86"},{"last_affected":"0.86"},{"introduced":"0.87"},{"last_affected":"0.87"},{"introduced":"0.88"},{"last_affected":"0.88"},{"introduced":"0.89"},{"last_affected":"0.89"},{"introduced":"0.90"},{"last_affected":"0.90"},{"introduced":"0.91"},{"last_affected":"0.91"},{"introduced":"0.92"},{"last_affected":"0.92"}],"source":"AFFECTED_FIELD"}],"cna_assigner":"VulDB","cwe_ids":["CWE-74","CWE-89"]},"references":[{"type":"ADVISORY","url":"https://github.com/Bahmni/bahmni-core/security/advisories/GHSA-cg9w-r5g6-cxq5"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15477.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15477"},{"type":"ADVISORY","url":"https://vuldb.com/cve/CVE-2026-15477"},{"type":"ADVISORY","url":"https://vuldb.com/submit/836079"},{"type":"ADVISORY","url":"https://vuldb.com/vuln/377782"},{"type":"REPORT","url":"https://vuldb.com/vuln/377782/cti"},{"type":"FIX","url":"https://bahmni.atlassian.net/wiki/spaces/BAH/pages/5519474693/Bahmni+Security+Patch+July+02+2026+Release+Notes"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/bahmni/bahmni-core","events":[{"introduced":"74a33668784ead3e41ce20c0146f21375ddb9ad2"},{"last_affected":"74a33668784ead3e41ce20c0146f21375ddb9ad2"}],"database_specific":{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"0.9"},{"last_affected":"0.9"},{"introduced":"0.93"},{"last_affected":"0.93"}]}}],"versions":["0.9","0.93.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-15477.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}]}