CVE-2021-40375

Apperta Foundation OpenEyes 3.5.1 allows remote attackers to view the sensitive information of patients without having the intended level of privilege. Despite OpenEyes returning a Forbidden error message, the contents of a patient's profile are still returned in the server response. This response can be read in an intercepting proxy or by viewing the page source. Sensitive information returned in responses includes patient PII and medication records or history.

• CWE-200

• https://github.com/DCKento/CVE-2021-40375Exploit, Third Party Advisory
• https://openeyes.apperta.org/Product, Vendor Advisory
• https://github.com/DCKento/CVE-2021-40375Exploit, Third Party Advisory
• https://openeyes.apperta.org/Product, Vendor Advisory

Published

Apr 6, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-40368A vulnerability has been identified in SIMATIC S7-400 CPU 4…7.5
• CVE-2021-40369A carefully crafted plugin link invocation could trigger an …6.1
• CVE-2021-4037A vulnerability was found in the fs/inode.c:inode_init_owner…4.4
• CVE-2021-40371Gridpro Request Management for Windows Azure Pack before 2.0…9.8
• CVE-2021-40373playSMS before 1.4.5 allows Arbitrary Code Execution by ente…9.8
• CVE-2021-40374A stored cross-site scripting (XSS) vulnerability was identi…5.4
• CVE-2021-40376otris Update Manager 1.2.1.0 allows local users to achieve S…7.8
• CVE-2021-40377SmarterTools SmarterMail 16.x before build 7866 has stored X…5.4
• CVE-2021-40378An issue was discovered on Compro IP70 2.08_7130218, IP570 2…8.1
• CVE-2021-40379An issue was discovered on Compro IP70 2.08_7130218, IP570 2…7.5
• CVE-2021-4038Cross Site Scripting (XSS) vulnerability in McAfee Network S…4.8
• CVE-2021-40380An issue was discovered on Compro IP70 2.08_7130218, IP570 2…7.5