CVE-2016-6272

7.5 highEPSS 21%

High (7.5) in epic mychart. EPSS 21% chance of exploitation in the next 30 days.

XPath injection vulnerability in Epic MyChart allows remote attackers to access contents of an XML document containing static display strings, such as field labels, via the topic parameter to help.asp. NOTE: this was originally reported as a SQL injection vulnerability, but this may be inaccurate.

Severity

CVSS 3.0

7.5 high

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 21% chance of exploitation in the next 30 days; higher than 97% of CVEs (scores of 2026-10-31)
CWE: CWE-91
Published: 2018-02-20
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

epic:mychart

References

http://packetstormsecurity.com/files/146418/EPIC-MyChart-SQL-Injection.html
https://www.exploit-db.com/exploits/44098/
http://packetstormsecurity.com/files/146418/EPIC-MyChart-SQL-Injection.html
https://www.exploit-db.com/exploits/44098/

Check your stack JSON