| Package | Affected versions | Patched versions |
|---|---|---|
| clinic | = 7.1.26 | |
| clinic api | = 1.3.0 |
VSee Clinic 7.1.26 and API 1.3.0 contain an Insecure Direct Object Reference (IDOR) vulnerability in the /v1.3.0/api/files endpoint. An authenticated attacker can manipulate the 'remark' request parameter to enumerate, retrieve, and delete files belonging to other users on the application server.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free