CGM vulnerabilities
36 CVEs and advisories name CGM as an affected vendor, newest first. Follow it as a feed.
- CVE-2025-58403Reflected Cross-Site Scripting (XSS) in CGM CLININET
- CVE-2025-30054Local Privilege Escalation in CGM CLININET
- CVE-2025-30053Missing Authentication in CGM CLININET
- CVE-2025-30052Authentication Bypass via IP Spoofing in CGM CLININET rsyncd
- CVE-2025-30051Insecure File Permissions in CGM CLININET
- CVE-2025-30050Remote Code Execution in CGM CLININET
- CVE-2025-30049Use of Unsalted MD5 Password Hashes in CGM CLININET
- CVE-2025-30047Remote Code Execution via Java Deserialization in CGM CLININET
- CVE-2025-30046Remote Code Execution in CGM CLININET
- CVE-2025-30045Code Injection in CGM CLININET
- CVE-2025-30043Missing Authentication in CGM CLININET
- CVE-2025-58406Lack of HTTP Response Headers
- CVE-2025-58405Lack of protection mechanisms against Clickjacking attacks
- CVE-2025-58402Insecure Direct Object Reference Message ID
- CVE-2025-30062SQL injection in CheckUnitCodeAndKey.pl
- CVE-2025-30044RCE on uhcapache user permissions
- CVE-2025-30042Session generation possible with certificate number only
- CVE-2025-30035Lack of API authentication allowing session generation for any user
- CVE-2025-10350SQL injection in CGM NETRAAD
- CVE-2025-30064Possibility to generate a session for any user via the "ex:action" parameter after obtaining access to the JWT key
- CVE-2025-30063Excessive permissions on configuration files containing database logins and passwords
- CVE-2025-30061SQL injection in utils/Reporter/OpenReportWindow.pl via the UserID parameter
- CVE-2025-30060SQL injection in ReturnUserUnitsXML.pl via the UserID parameter
- CVE-2025-30059Authenticated SQL injection in PrepareCDExportJSON.pl
- CVE-2025-30058SQL injection in getPatientIdentifier function of PatientService.pl
- CVE-2025-30057Authenticated RCE with uhcapache privileges in ConvertToPDF
- CVE-2025-30056Calling system commands via RunCommand
- CVE-2025-30055Conditional RCE via the "system" function
- CVE-2025-30048Unauthenticated access to module configuration endpoint
- CVE-2025-30041Missing authentication in APIs returning statistical data along with session IDs