CVE-2015-6538

9.8 criticalEPSS 1.9%

Critical (9.8) in ephiphanyheathdata cardio server. EPSS 1.9% chance of exploitation in the next 30 days.

The login page in Epiphany Cardio Server 3.3, 4.0, and 4.1 mishandles authentication requests, which allows remote attackers to conduct LDAP injection attacks, and consequently bypass intended access restrictions, via a crafted URL.

Severity

CVSS 3.0

9.8 critical

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.9% chance of exploitation in the next 30 days; higher than 79% of CVEs (scores of 2026-10-31)
Published: 2015-12-27
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

ephiphanyheathdata:cardio_server

References

http://www.epiphanyhealthdata.com/blog/certresponse
https://www.kb.cert.org/vuls/id/630239
http://www.epiphanyhealthdata.com/blog/certresponse
https://www.kb.cert.org/vuls/id/630239

Check your stack JSON