PT-2026-146997

CVE-2026-126091

·

Published

2026-11-13

·

Updated

2026-11-13

Description by

CVSS 3.1
7.5
High
MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Dental practice sites hosted with iDentalSoft send a JSON response to any user who loads certain pages containing sensitive information, including OAuth credentials, password hashes, and PII. Fixed in iDentalSoft 14.0.3.
Exploitability
Fix
Researchers
Vendors
Affected products
Weakness enumeration
CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory
Related identifiers
CVE-2026-126091
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com