CVE-2023-40278

An issue was discovered in OpenClinic GA 5.247.01. An Information Disclosure vulnerability has been identified in the printAppointmentPdf.jsp component of OpenClinic GA. By changing the AppointmentUid parameter, an attacker can determine whether a specific appointment exists based on the error message.

• CWE-200

• https://github.com/BugBountyHunterCVE/CVE-2023-40278/blob/main/CVE-2023-40278_Information-Disclosure_OpenClinic-GA_5.247.01_Report.mdExploit, Third Party Advisory
• https://sourceforge.net/projects/open-clinic/Product
• https://github.com/BugBountyHunterCVE/CVE-2023-40278/blob/main/CVE-2023-40278_Information-Disclosure_OpenClinic-GA_5.247.01_Report.mdExploit, Third Party Advisory
• https://sourceforge.net/projects/open-clinic/Product

Published

Mar 19, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-40272Apache Airflow Spark Provider, versions before 4.1.3, is aff…7.5
• CVE-2023-40273The session fixation vulnerability allowed the authenticated…8
• CVE-2023-40274An issue was discovered in zola 0.13.0 through 0.17.2. The c…7.5
• CVE-2023-40275An issue was discovered in OpenClinic GA 5.247.01. It allows…9.1
• CVE-2023-40276An issue was discovered in OpenClinic GA 5.247.01. An Unauth…9.1
• CVE-2023-40277An issue was discovered in OpenClinic GA 5.247.01. A Reflect…6.1
• CVE-2023-40279An issue was discovered in OpenClinic GA 5.247.01. An attack…7.5
• CVE-2023-4028A buffer overflow has been identified in the SystemUserMaste…6.7
• CVE-2023-40280An issue was discovered in OpenClinic GA 5.247.01. An attack…7.5
• CVE-2023-40281EC-CUBE 2.11.0 to 2.17.2-p1 contain a cross-site scripting v…4.8
• CVE-2023-40282Improper authentication vulnerability in Rakuten WiFi Pocket…5.4
• CVE-2023-40283An issue was discovered in l2cap_sock_release in net/bluetoo…7.8