[ Vendor · 11 CVEs ]
CGM
CVEs affecting CGM published in the last 30 days, plus any CGM CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2025-30052 | 23 Oct 2026 | CVSS 8.8 | CGM CLININETThe rsyncd service of the CGM CLININET is vulnerable to Authentication Bypass via IP spoofing. Access is granted based solely on the client's source… | |
| CVE-2025-30053 | 23 Oct 2026 | CVSS 6.9 | CGM CLININETThe CGM CLININET application runs the cgm-updater process listening on an open network port without any authentication. The vulnerability was… | |
| CVE-2025-30054 | 23 Oct 2026 | CVSS 9.3 | CGM CLININETCGM CLININET is vulnerable to local privilege escalation. The service that processes incoming HL7 messages runs with root privileges, but due to… | |
| CVE-2025-58403 | 23 Oct 2026 | CVSS 5.1 | CGM CLININETCGM CLININET is vulnerable to Reflected Cross-Site Scripting (XSS) due to improper neutralization of user-supplied data. A remote unauthenticated… | |
| CVE-2025-30045 | 23 Oct 2026 | CVSS 8.6 | CGM CLININETCGM CLININET is vulnerable to Code Injection in the ConvExpr function, which processes Perl expressions into RTF document content. Due to improper… | |
| CVE-2025-30046 | 23 Oct 2026 | CVSS 9.0 | CGM CLININETIn the CGM CLININET application server, multiple processes responsible for HL7 communication with external systems run with root privileges while… | |
| CVE-2025-30047 | 23 Oct 2026 | CVSS 9.4 | CGM CLININETCGM CLININET is vulnerable to Remote Code Execution caused by deserialization of untrusted data. The server exposes an HTTP-based API, used by the… | |
| CVE-2025-30049 | 23 Oct 2026 | CVSS 8.2 | CGM CLININETThe CGM CLININET application stores user passwords as unsalted MD5 hashes. This issue was fixed in versions 2026.MS1 and 2026.MS3 | |
| CVE-2025-30050 | 23 Oct 2026 | CVSS 9.4 | CGM CLININETCGM CLININET is vulnerable to Code Injection in the RunCGI.pm component, which dynamically imports the module specified as a query parameter and… | |
| CVE-2025-30051 | 23 Oct 2026 | CVSS 6.8 | CGM CLININETThe CGM CLININET application stores the production database login and password, as well as RabbitMQ broker credentials, in the SysIO.pl configuration… | |
| CVE-2025-30043 | 23 Oct 2026 | CVSS 7.1 | CGM CLININETCGM CLININET is vulnerable to Missing Authentication for Critical Function in the /DocManagment path. The endpoint is accessible without… |