CGM vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2025-30054 CGM CLININET is vulnerable to local privilege escalation.Critical 9.3 · Oct 23, 2026
• CVE-2025-30052 The rsyncd service of the CGM CLININET is vulnerable to Authentication Bypass via IP spoofing.High 8.8 · Oct 23, 2026
• CVE-2025-30050 CGM CLININET is vulnerable to Code Injection in the RunCGI.pm component, which dynamically imports the module specified as a query parameter and executes code fCritical 9.4 · Oct 23, 2026
• CVE-2025-30049 The CGM CLININET application stores user passwords as unsalted MD5 hashes.High 8.2 · Oct 23, 2026
• CVE-2025-30047 CGM CLININET is vulnerable to Remote Code Execution caused by deserialization of untrusted data.Critical 9.4 · Oct 23, 2026
• CVE-2025-30046 In the CGM CLININET application server, multiple processes responsible for HL7 communication with external systems run with root privileges while processing untCritical 9 · Oct 23, 2026
• CVE-2025-30045 CGM CLININET is vulnerable to Code Injection in the ConvExpr function, which processes Perl expressions into RTF document content.High 8.6 · Oct 23, 2026
• CVE-2025-30043 CGM CLININET is vulnerable to Missing Authentication for Critical Function in the /DocManagment path.High 7.1 · Oct 23, 2026
• CVE-2025-58402 The CGM CLININET application uses direct, sequential object identifiers "MessageID" without proper authorization checks.High 7.1 · Mar 2, 2026
• CVE-2025-30044 In the endpoints "/cgi-bin/CliniNET.prd/utils/usrlogstat_simple.pl", "/cgi-bin/CliniNET.prd/utils/usrlogstat.pl", "/cgi-bin/CliniNET.prd/utils/userlogstat2.pl",Critical 9.4 · Mar 2, 2026
• CVE-2025-30042 The CGM CLININET system provides smart card authentication; however, authentication is conducted locally on the client device, and, in reality, only the certifiCritical 9 · Mar 2, 2026
• CVE-2025-30035 The vulnerability enables an attacker to fully bypass authentication in CGM CLININET and gain access to any active user account by supplying only the username, Critical 9 · Mar 2, 2026
• CVE-2025-10350 SQL Injection vulnerability in "imageserver" module when processing C-FIND queries in CGM NETRAAD software allows attacker connected to PACS gaining access to dHigh 8.8 · Mar 2, 2026
• CVE-2025-30064 An insufficiently secured internal function allows session generation for arbitrary users.High 8.8 · Aug 27, 2025
• CVE-2025-30063 The configuration file containing database logins and passwords is readable by any local user.Critical 9.4 · Aug 27, 2025
• CVE-2025-30057 In UHCRTFDoc, the filename parameter can be exploited to execute arbitrary code via command injection into the system() call in the ConvertToPDF function.Critical 9.4 · Aug 27, 2025
• CVE-2025-30056 The RunCommand function accepts any parameter, which is then passed for execution in the shell.Critical 9.4 · Aug 27, 2025
• CVE-2025-30055 The "system" function receives untrusted input from the user.Critical 9 · Aug 27, 2025
• CVE-2025-30041 The paths "/cgi-bin/CliniNET.prd/utils/userlogstat.pl", "/cgi-bin/CliniNET.prd/utils/usrlogstat.pl", and "/cgi-bin/CliniNET.prd/utils/dblogstat.pl" expose data Critical 9 · Aug 27, 2025
• CVE-2025-30040 The vulnerability allows unauthenticated users to download a file containing session ID data by directly accessing the "/cgi-bin/CliniNET.prd/utils/userlogxls.pCritical 9 · Aug 27, 2025
• CVE-2025-30039 Unauthenticated access to the "/cgi-bin/CliniNET.prd/GetActiveSessions.pl" endpoint allows takeover of any user session logged into the system, including users Critical 9 · Aug 27, 2025
• CVE-2025-30038 The vulnerability consists of a session ID leak when saving a file downloaded from CGM CLININET.High 7.3 · Aug 27, 2025
• CVE-2025-30037 The system exposes several endpoints, typically including "/int/" in their path, that should be restricted to internal services, but are instead publicly accessHigh 8.8 · Aug 27, 2025
• CVE-2025-30036 Stored XSS vulnerability exists in the "Oddział" (Ward) module, in the death diagnosis description field, and allows the execution of arbitrary JavaScript code.High 8.8 · Aug 27, 2025
• CVE-2025-2313 In the Print.pl service, the "uhcPrintServerPrint" function allows execution of arbitrary code via the "CopyCounter" parameter.Critical 9.4 · Aug 27, 2025