CVE-2016-6272

high · 7.5

XPath injection vulnerability in Epic MyChart allows remote attackers to access contents of an XML document containing static display strings, such as field labels, via the topic parameter to help.asp. NOTE: this was originally reported as a SQL injection vulnerability, but this may be inaccurate.

7.5

CVSS

20.9%

EPSS (exploit prob.)

97th

EPSS percentile

2018-02-20

Published

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses

CWE-91

Affected products

Vendor	Product	Affected versions
epic	mychart	all versions

Check a specific version with /api/v1/cve/match.

References

http://packetstormsecurity.com/files/146418/EPIC-MyChart-SQL-Injection.html
https://www.exploit-db.com/exploits/44098/
http://packetstormsecurity.com/files/146418/EPIC-MyChart-SQL-Injection.html
https://www.exploit-db.com/exploits/44098/

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2016-6272