# cve.now: CGM

The newest entries naming CGM as an affected vendor (up to 200), of 36 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2025-58403](https://cve.now/CVE-2025-58403.md): Reflected Cross-Site Scripting (XSS) in CGM CLININET (CVSS 5.1)
- [CVE-2025-30054](https://cve.now/CVE-2025-30054.md): Local Privilege Escalation in CGM CLININET (CVSS 9.3)
- [CVE-2025-30053](https://cve.now/CVE-2025-30053.md): Missing Authentication in CGM CLININET (CVSS 6.9)
- [CVE-2025-30052](https://cve.now/CVE-2025-30052.md): Authentication Bypass via IP Spoofing in CGM CLININET rsyncd (CVSS 8.8)
- [CVE-2025-30051](https://cve.now/CVE-2025-30051.md): Insecure File Permissions in CGM CLININET (CVSS 6.8)
- [CVE-2025-30050](https://cve.now/CVE-2025-30050.md): Remote Code Execution in CGM CLININET (CVSS 9.4)
- [CVE-2025-30049](https://cve.now/CVE-2025-30049.md): Use of Unsalted MD5 Password Hashes in CGM CLININET (CVSS 8.2)
- [CVE-2025-30047](https://cve.now/CVE-2025-30047.md): Remote Code Execution via Java Deserialization in CGM CLININET (CVSS 9.4)
- [CVE-2025-30046](https://cve.now/CVE-2025-30046.md): Remote Code Execution in CGM CLININET (CVSS 9.0)
- [CVE-2025-30045](https://cve.now/CVE-2025-30045.md): Code Injection in CGM CLININET (CVSS 8.6)
- [CVE-2025-30043](https://cve.now/CVE-2025-30043.md): Missing Authentication in CGM CLININET (CVSS 7.1)
- [CVE-2025-58406](https://cve.now/CVE-2025-58406.md): Lack of HTTP Response Headers (CVSS 5.3)
- [CVE-2025-58405](https://cve.now/CVE-2025-58405.md): Lack of protection mechanisms against Clickjacking attacks (CVSS 5.3)
- [CVE-2025-58402](https://cve.now/CVE-2025-58402.md): Insecure Direct Object Reference Message ID (CVSS 7.1)
- [CVE-2025-30062](https://cve.now/CVE-2025-30062.md): SQL injection in CheckUnitCodeAndKey.pl (CVSS 6.9)
- [CVE-2025-30044](https://cve.now/CVE-2025-30044.md): RCE on uhcapache user permissions (CVSS 9.4)
- [CVE-2025-30042](https://cve.now/CVE-2025-30042.md): Session generation possible with certificate number only (CVSS 9.0)
- [CVE-2025-30035](https://cve.now/CVE-2025-30035.md): Lack of API authentication allowing session generation for any user (CVSS 9.0)
- [CVE-2025-10350](https://cve.now/CVE-2025-10350.md): SQL injection in CGM NETRAAD (CVSS 8.8)
- [CVE-2025-30064](https://cve.now/CVE-2025-30064.md): Possibility to generate a session for any user via the "ex:action" parameter after obtaining access to the JWT key (CVSS 8.8)
- [CVE-2025-30063](https://cve.now/CVE-2025-30063.md): Excessive permissions on configuration files containing database logins and passwords (CVSS 9.4)
- [CVE-2025-30061](https://cve.now/CVE-2025-30061.md): SQL injection in utils/Reporter/OpenReportWindow.pl via the UserID parameter (CVSS 6.9)
- [CVE-2025-30060](https://cve.now/CVE-2025-30060.md): SQL injection in ReturnUserUnitsXML.pl via the UserID parameter (CVSS 6.9)
- [CVE-2025-30059](https://cve.now/CVE-2025-30059.md): Authenticated SQL injection in PrepareCDExportJSON.pl (CVSS 6.9)
- [CVE-2025-30058](https://cve.now/CVE-2025-30058.md): SQL injection in getPatientIdentifier function of PatientService.pl (CVSS 6.9)
- [CVE-2025-30057](https://cve.now/CVE-2025-30057.md): Authenticated RCE with uhcapache privileges in ConvertToPDF (CVSS 9.4)
- [CVE-2025-30056](https://cve.now/CVE-2025-30056.md): Calling system commands via RunCommand (CVSS 9.4)
- [CVE-2025-30055](https://cve.now/CVE-2025-30055.md): Conditional RCE via the "system" function (CVSS 9.0)
- [CVE-2025-30048](https://cve.now/CVE-2025-30048.md): Unauthenticated access to module configuration endpoint (CVSS 5.3)
- [CVE-2025-30041](https://cve.now/CVE-2025-30041.md): Missing authentication in APIs returning statistical data along with session IDs (CVSS 9.0)
- [CVE-2025-30040](https://cve.now/CVE-2025-30040.md): Missing authentication in API returning request logs containing session IDs (CVSS 9.0)
- [CVE-2025-30039](https://cve.now/CVE-2025-30039.md): Missing authentication in API returning a list of all active sessions (CVSS 9.0)
- [CVE-2025-30038](https://cve.now/CVE-2025-30038.md): Session ID leakage in Zone.Identifier of downloaded files (CVSS 7.3)
- [CVE-2025-30037](https://cve.now/CVE-2025-30037.md): Missing authentication in APIs allowing data retrieval and modification (CVSS 8.8)
- [CVE-2025-30036](https://cve.now/CVE-2025-30036.md): Stored XSS permitting session takeover of arbitrary user (CVSS 8.8)
- [CVE-2025-2313](https://cve.now/CVE-2025-2313.md): RCE via Print.pl in uhcPrintServerPrint (CVSS 9.4)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/cgm
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.