CCGM

Products

Exploited and recent CVEs

• CVE-2025-58403 Medium 5.1 Reflected Cross-Site Scripting (XSS) in CGM CLININET 0.5%
• CVE-2025-30054 Critical 9.3 Local Privilege Escalation in CGM CLININET 0.1%
• CVE-2025-30053 Medium 6.9 Missing Authentication in CGM CLININET 0.4%
• CVE-2025-30052 High 8.8 Authentication Bypass via IP Spoofing in CGM CLININET rsyncd 0.3%
• CVE-2025-30051 Medium 6.8 Insecure File Permissions in CGM CLININET <0.1%
• CVE-2025-30050 Critical 9.4 Remote Code Execution in CGM CLININET 0.2%
• CVE-2025-30049 High 8.2 Use of Unsalted MD5 Password Hashes in CGM CLININET 0.2%
• CVE-2025-30047 Critical 9.4 Remote Code Execution via Java Deserialization in CGM CLININET 0.4%
• CVE-2025-30046 Critical 9.0 Remote Code Execution in CGM CLININET 0.3%
• CVE-2025-30045 High 8.6 Code Injection in CGM CLININET 0.2%
• CVE-2025-30043 High 7.1 Missing Authentication in CGM CLININET 0.2%
• CVE-2025-58406 Medium 5.3 Lack of HTTP Response Headers 0.2%
• CVE-2025-58405 Medium 5.3 Lack of protection mechanisms against Clickjacking attacks 0.2%
• CVE-2025-58402 High 7.1 Insecure Direct Object Reference Message ID 0.2%
• CVE-2025-30062 Medium 6.9 SQL injection in CheckUnitCodeAndKey.pl 0.2%
• CVE-2025-30044 Critical 9.4 RCE on uhcapache user permissions 0.6%
• CVE-2025-30042 Critical 9.0 Session generation possible with certificate number only <0.1%
• CVE-2025-30035 Critical 9.0 Lack of API authentication allowing session generation for any user 0.3%
• CVE-2025-10350 High 8.8 SQL injection in CGM NETRAAD 0.2%
• CVE-2025-30064 High 8.8 Possibility to generate a session for any user via the "ex:action" parameter after obtaining access to the JWT key <0.1%
• CVE-2025-30063 Critical 9.4 Excessive permissions on configuration files containing database logins and passwords 0.1%
• CVE-2025-30061 Medium 6.9 SQL injection in utils/Reporter/OpenReportWindow.pl via the UserID parameter 0.2%
• CVE-2025-30060 Medium 6.9 SQL injection in ReturnUserUnitsXML.pl via the UserID parameter 0.2%
• CVE-2025-30059 Medium 6.9 Authenticated SQL injection in PrepareCDExportJSON.pl 0.2%
• CVE-2025-30058 Medium 6.9 SQL injection in getPatientIdentifier function of PatientService.pl 0.2%
• CVE-2025-30057 Critical 9.4 Authenticated RCE with uhcapache privileges in ConvertToPDF 0.7%
• CVE-2025-30056 Critical 9.4 Calling system commands via RunCommand 0.2%
• CVE-2025-30055 Critical 9.0 Conditional RCE via the "system" function 0.2%
• CVE-2025-30048 Medium 5.3 Unauthenticated access to module configuration endpoint 0.2%
• CVE-2025-30041 Critical 9.0 Missing authentication in APIs returning statistical data along with session IDs 0.2%