Skip to content
OpenAdvisories

Vendor

VSee

2 known vulnerabilities.

Products

Clinic 2
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 8.7
    CVE-2026-13381

    VSee Clinic and API Insecure Direct Object Reference in File API Allows Unauthorized File Access and Deletion

    VSee Clinic 7.1.26 and API 1.3.0 contain an Insecure Direct Object Reference (IDOR) vulnerability in the /v1.3.0/api/files endpoint. An authenticated attacker can manipulate the 'remark' request parameter to enumerate, retrieve, and delete files belonging to …

    VSee Clinic