Vulnerability feed
CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run
| Expand | Severity |
Score |
Advisory |
Title |
Source |
Flags |
Published |
|---|---|---|---|---|---|---|---|
| Medium | 5.1 | CVE-2025-58403 |
CGM CLININET is vulnerable to Reflected Cross-Site Scripting (XSS) due to improper neutralization of user-supplied data
CGMCGM CLININET
|
NVD | |||
|
CVE-2025-58403CGM CLININET is vulnerable to Reflected Cross-Site Scripting (XSS) due to improper neutralization of user-supplied data
Executive summaryCGM CLININET, a clinical software product, has multiple vulnerabilities disclosed by CERT Polska, and the advisory describes several as allowing remote code execution with root privileges and patient document exposure. The advisory's stated fix is version 2026.MS3 for several of the issues, and it says later versions may also be vulnerable for others. Customers should apply the vendor update and follow the vendor's guidance, which the advisory does not fully detail. Technical summaryThe advisory lists ten CVEs in CGM CLININET, including missing authentication (CWE-306), code injection (CWE-94), unsafe deserialization (CWE-502), excessive privileges (CWE-250), weak password hashing (CWE-916), insecure permissions (CWE-732), IP-based authentication bypass (CWE-290), and reflected XSS (CWE-79). Most affected versions are stated as all before or through 2026.MS3, and the advisory states that the fix is 2026.MS3, with 2026.MS1 also named for CVE-2025-30049. Several issues require adjacent network access, authenticated high-privileged access, or local access, while CVE-2025-58403 is a remote unauthenticated reflected XSS requiring a victim to visit a crafted URL. The advisory does not state workarounds, detection guidance, or whether exploitation has been observed, and it does not provide CVSS scores. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from cert.pl/en/posts/2026/10/CVE-2025-30043 Impact if exploitedConfidentialityNone IntegrityNone AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Critical | 9.3 | CVE-2025-30054 |
CGM CLININET is vulnerable to local privilege escalation
CGMCGM CLININET
|
NVD | |||
|
CVE-2025-30054CGM CLININET is vulnerable to local privilege escalation
Executive summaryThe advisory describes a set of vulnerabilities in CGM CLININET software, a product affected across many versions up to 2026.MS3. Several flaws allow attackers on the adjacent network or with low privileges to reach patient documents, run code with root privileges, or take over the system, and some are rated severe in impact. The advisory states that fixed versions exist for some issues (2026.MS1 and 2026.MS3) and that later versions may also be vulnerable for others, so the vendor's update guidance should be followed. Technical summaryThe advisory lists multiple weakness types, including missing authentication (CWE-306), code injection (CWE-94), execution with unnecessary privileges (CWE-250), insecure deserialization (CWE-502), weak password hashing (CWE-916), incorrect permission assignment (CWE-732, CWE-732), authentication bypass by IP spoofing (CWE-290), and reflected cross-site scripting (CWE-79). Several issues require adjacent network access, and CVE-2025-30045, CVE-2025-30050 and others require an authenticated or local attacker, while CVE-2025-58403 can be triggered by a crafted URL visited by a user. Affected versions are stated as all before or all through 2026.MS3, and fixed versions are stated as 2026.MS3 for most issues and 2026.MS1 and 2026.MS3 for CVE-2025-30049. Workarounds and detection guidance are not stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from cert.pl/en/posts/2026/10/CVE-2025-30043 Impact if exploitedConfidentialityHigh IntegrityHigh AvailabilityHigh
How it is exploited
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 6.9 | CVE-2025-30053 |
The CGM CLININET application runs the cgm-updater process listening on an open network port without any authentication.
The vulnerability was confirmed to affect versions...
CGMCGM CLININET
|
NVD | |||
|
CVE-2025-30053The CGM CLININET application runs the cgm-updater process listening on an open network port without any authentication.
The vulnerability was confirmed to affect versions...
Executive summaryThe CGM CLININET application, a clinical software product, contains a vulnerability in its cgm-updater process that listens on an open network port without authentication. The advisory text provided is part of a larger set of CGM CLININET flaws published by CERT Polska, and the advisory does not state a severity rating for this specific CVE. The advisory does not state a vendor-recommended action for CVE-2025-30053 beyond the fixes noted for other CVEs in the set, so the fix status for this CVE is not stated. Technical summaryThis is a missing authentication flaw (CWE-306) in the cgm-updater process, which listens on an open network port without requiring any credentials. The advisory states the vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable, and the vulnerable version range is listed as All through 2026.MS3. No fixed version is stated for CVE-2025-30053, and no workaround, CVSS score, exploitation status, or detection guidance is stated. The attack vector and required network position for this specific CVE are not stated in the advisory text provided. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from cert.pl/en/posts/2026/10/CVE-2025-30043 Impact if exploitedConfidentialityLow IntegrityLow AvailabilityLow
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 8.8 | CVE-2025-30052 |
The rsyncd service of the CGM CLININET is vulnerable to Authentication Bypass via IP spoofing
CGMCGM CLININET
|
NVD | |||
|
CVE-2025-30052The rsyncd service of the CGM CLININET is vulnerable to Authentication Bypass via IP spoofing
Executive summaryThe advisory describes a set of vulnerabilities in CGM CLININET software, a product that the advisory describes as an application server handling patient documents and clinical messaging. Several flaws allow attackers on the adjacent or local network, or in some cases remote unauthenticated attackers, to run code with root privileges or access patient data. The advisory does not state a severity rating, and it does not describe a vendor recommendation beyond noting that fixes were released in version 2026.MS3 for most issues. Technical summaryThe advisory lists about ten CVEs in CGM CLININET, including missing authentication (CWE-306), code injection (CWE-94), deserialization of untrusted data (CWE-502), unsalted MD5 password hashing (CWE-916), improper permission assignment (CWE-732), authentication bypass by IP spoofing against the rsyncd service (CWE-290), and reflected cross-site scripting (CWE-79). Several are reachable from the adjacent or local network, and CVE-2025-58403 can be triggered by a crafted URL from a remote unauthenticated attacker. Affected versions are stated as all before or all through 2026.MS3, and fixed versions are stated as 2026.MS3, with 2026.MS1 and 2026.MS3 named for CVE-2025-30049. The advisory says later versions may also be vulnerable for several issues, and it does not state a workaround. No detection guidance or exploitation status is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from cert.pl/en/posts/2026/10/CVE-2025-30043 Impact if exploitedConfidentialityNone IntegrityHigh AvailabilityHigh
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 6.8 | CVE-2025-30051 |
The CGM CLININET application stores the production database login and password, as well as RabbitMQ broker credentials, in the SysIO.pl configuration file
CGMCGM CLININET
|
NVD | |||
|
CVE-2025-30051The CGM CLININET application stores the production database login and password, as well as RabbitMQ broker credentials, in the SysIO.pl configuration file
Executive summaryThe advisory describes many vulnerabilities in CGM CLININET software, a healthcare application, affecting versions before or through 2026.MS3. Several flaws let attackers reach patient documents, run code with root privileges, or read stored credentials. The advisory does not state a single severity rating, and the vendor's fix is to update to version 2026.MS3 or later where a fix is given. Technical summaryThe advisory lists CWE classes including missing authentication (CWE-306), code injection (CWE-94, CWE-94), unnecessary privileges (CWE-250), unsafe deserialization (CWE-502), weak password hashing (CWE-916), incorrect permissions (CWE-732, CWE-732), authentication bypass by spoofing (CWE-290), and reflected XSS (CWE-79). Many issues require adjacent network access or an authenticated high-privileged or local account, while the XSS issue needs a victim to visit a crafted URL. Fixed versions are stated as 2026.MS3 for most entries and 2026.MS1 and 2026.MS3 for CVE-2025-30049, while several entries say only that later versions may also be vulnerable. Workarounds and detection guidance are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from cert.pl/en/posts/2026/10/CVE-2025-30043 Impact if exploitedConfidentialityHigh IntegrityNone AvailabilityNone
How it is exploited
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Critical | 9.4 | CVE-2025-30050 |
CGM CLININET is vulnerable to Code Injection in the RunCGI.pm component, which dynamically imports the module specified as a query parameter and executes code from untrusted...
CGMCGM CLININET
|
NVD | |||
|
CVE-2025-30050CGM CLININET is vulnerable to Code Injection in the RunCGI.pm component, which dynamically imports the module specified as a query parameter and executes code from untrusted...
Executive summaryCGM CLININET, a clinical software product, has a code injection flaw (CVE-2025-30050) in its RunCGI.pm component. An attacker on the adjacent network can exploit it to run arbitrary code with root privileges, and the advisory describes the severity as high-impact but does not state a CVSS score. The advisory says the issue was fixed in version 2026.MS3, which is the recommended remediation. Technical summaryCVE-2025-30050 is classified as Improper Control of Generation of Code ('Code Injection', CWE-94). The RunCGI.pm component dynamically imports a module named in a query parameter and executes code from untrusted user data, so a crafted request from an adjacent network can load an attacker-controlled module and execute code as root. The advisory says the affected versions are all before 2026.MS3 and that the issue was fixed in version 2026.MS3. No workaround, CVSS score, or exploitation status is stated, and no detection guidance is given. The advisory also covers several other CGM CLININET CVEs (CVE-2025-30043 through CVE-2025-30054 and CVE-2025-58403), which are listed separately in the source but are not the subject of this summary. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from cert.pl/en/posts/2026/10/CVE-2025-30043 Impact if exploitedConfidentialityHigh IntegrityHigh AvailabilityHigh
How it is exploited
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 8.2 | CVE-2025-30049 |
The CGM CLININET application stores user passwords as unsalted MD5 hashes.
This issue was fixed in versions 2026.MS1 and 2026.MS3
CGMCGM CLININET
|
NVD | |||
|
CVE-2025-30049The CGM CLININET application stores user passwords as unsalted MD5 hashes.
This issue was fixed in versions 2026.MS1 and 2026.MS3
Executive summaryThe CGM CLININET application, a clinical software product, contains a flaw in how it stores user passwords as unsalted MD5 hashes. The advisory says the issue is fixed in versions 2026.MS1 and 2026.MS3, and it is one of several CGM CLININET vulnerabilities disclosed together by CERT Polska. The advisory does not give a severity score for this specific issue, and it does not state whether it has been exploited. Technical summaryThis is a weak password storage issue (CWE-916, use of password hash with insufficient computational effort), and the advisory describes passwords as stored as unsalted MD5 hashes. The advisory does not state the attack vector or preconditions for this specific flaw. Affected versions are listed as all before 2026.MS1 and all before 2026.MS3, and the fix is stated as versions 2026.MS1 and 2026.MS3. No workaround and no detection guidance are stated for this CVE. The advisory also covers other CGM CLININET CVEs (CVE-2025-30043 through CVE-2025-30054 and CVE-2025-58403), which are described separately in the same text. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from cert.pl/en/posts/2026/10/CVE-2025-30043 Impact if exploitedConfidentialityHigh IntegrityNone AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Critical | 9.4 | CVE-2025-30047 |
CGM CLININET is vulnerable to Remote Code Execution caused by deserialization of untrusted data
CGMCGM CLININET
|
NVD | |||
|
CVE-2025-30047CGM CLININET is vulnerable to Remote Code Execution caused by deserialization of untrusted data
Executive summaryThe advisory describes multiple vulnerabilities in CGM CLININET software, a product affecting medical or clinical environments, that could let attackers on an adjacent or local network access patient documents, run code with root privileges, or take over sessions. The advisory does not state a severity rating for the issues, and the vendor's recommended action is to update to version 2026.MS3, which the advisory says fixes several of the flaws. Technical summaryThe advisory lists CVE-2025-30043 through CVE-2025-30054 and CVE-2025-58403, covering missing authentication, code injection (CWE-94), unnecessary privileges, unsafe deserialization of Java objects, unsalted MD5 password hashes, IP-based authentication bypass in rsyncd, plaintext credentials in SysIO.pl with insecure permissions, reflected XSS, and local privilege escalation through file permissions. Most issues are stated as affecting all versions before or through 2026.MS3, and several fixes are stated as landing in 2026.MS3 or 2026.MS1 and 2026.MS3. Preconditions vary, with several requiring adjacent network access and some requiring authentication or local access. No CVSS scores, workarounds, exploitation status, or detection guidance are stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from cert.pl/en/posts/2026/10/CVE-2025-30043 Impact if exploitedConfidentialityHigh IntegrityHigh AvailabilityHigh
How it is exploited
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Critical | 9.0 | CVE-2025-30046 |
In the CGM CLININET application server, multiple processes responsible for HL7 communication with external systems run with root privileges while processing untrusted data...
CGMCGM CLININET
|
NVD | |||
|
CVE-2025-30046In the CGM CLININET application server, multiple processes responsible for HL7 communication with external systems run with root privileges while processing untrusted data...
Executive summaryThe advisory covers multiple vulnerabilities in CGM CLININET, a clinical application server, and the text describes CVE-2025-30046 as allowing remote code execution with root privileges by an attacker on the adjacent network. The advisory does not give a CVSS score or a severity rating for this specific CVE. The advisory does not state a vendor recommendation beyond noting that some issues were fixed in version 2026.MS3. Technical summaryCVE-2025-30046 is classed as Execution with Unnecessary Privileges (CWE-250). HL7 communication processes in the CGM CLININET application server run as root while processing untrusted data from external systems, so an attacker on the adjacent network who can send data to these processes can achieve code execution as root. The advisory says the issue was confirmed in versions up to 2026.MS3 and that later versions may also be vulnerable. The advisory does not state a fixed version for CVE-2025-30046, does not give a workaround, and does not provide detection guidance. Exploitation in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from cert.pl/en/posts/2026/10/CVE-2025-30043 Impact if exploitedConfidentialityHigh IntegrityHigh AvailabilityHigh
How it is exploited
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 8.6 | CVE-2025-30045 |
CGM CLININET is vulnerable to Code Injection in the ConvExpr function, which processes Perl expressions into RTF document content
CGM, PerlCGM CLININET, Perl
|
NVD | |||
|
CVE-2025-30045CGM CLININET is vulnerable to Code Injection in the ConvExpr function, which processes Perl expressions into RTF document content
Executive summaryThis advisory covers multiple vulnerabilities in CGM CLININET software, a product affecting clinical environments, and the advisory describes several of them as allowing code execution with root privileges. The advisory does not state a single severity score for CVE-2025-30045, and the vulnerabilities cover several different weaknesses across the product. Versions up to and including 2026.MS3 are reported as affected for most issues, and the advisory states fixes are present in 2026.MS3 for several of them. Technical summaryCVE-2025-30045 is a code injection flaw in the ConvExpr function, which evaluates Perl expressions while converting them into RTF document content. Exploitation requires an authenticated attacker with high privileges, and successful exploitation executes arbitrary code with root privileges. The advisory states the issue was confirmed in versions up to 2026.MS3 and that later versions may also be vulnerable, and it does not state a fixed version for this CVE. No workaround, CVSS score, or detection guidance for CVE-2025-30045 is stated. The advisory also lists other CVEs in the same batch, including CVE-2025-30047 and CVE-2025-30050 which state fixes in 2026.MS3. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from cert.pl/en/posts/2026/10/CVE-2025-30043 Impact if exploitedConfidentialityHigh IntegrityHigh AvailabilityHigh
How it is exploited
CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 7.1 | CVE-2025-30043 |
CGM CLININET is vulnerable to Missing Authentication for Critical Function in the /DocManagment path
CGMCGM CLININET
|
NVD | |||
|
CVE-2025-30043CGM CLININET is vulnerable to Missing Authentication for Critical Function in the /DocManagment path
Executive summaryCERT Polska published a coordinated advisory covering ten vulnerabilities in CGM CLININET, a clinical software product. The advisory describes flaws that can expose patient documents and let attackers run code with root privileges, and it says fixes are available in version 2026.MS3. The advisory does not state a severity score. Technical summaryThe advisory lists CVE-2025-30043 through CVE-2025-30054 (excluding a few numbers) plus CVE-2025-58403, covering missing authentication, code injection, deserialization of untrusted data, unsalted MD5 password hashing, insecure file permissions, IP-spoofing authentication bypass, local privilege escalation, and reflected cross-site scripting. Several flaws require only an adjacent network position or a local account, while CVE-2025-58403 can be triggered by a remote unauthenticated attacker through a crafted URL. Vulnerable versions are listed as all before 2026.MS3 for some entries and all through 2026.MS3 for others, and fixed versions are stated for several entries as 2026.MS3 or 2026.MS1 and 2026.MS3. For many entries the advisory says later versions may also be vulnerable. No workarounds, CVSS scores, or detection guidance are stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from cert.pl/en/posts/2026/10/CVE-2025-30043 Impact if exploitedConfidentialityHigh IntegrityNone AvailabilityNone
How it is exploited
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||