CVE-2025-30061

SQL injection in utils/Reporter/OpenReportWindow.pl via the UserID parameter

In the "utils/Reporter/OpenReportWindow.pl" service, there is an SQL injection vulnerability through the "UserID" parameter.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Cgm

Products

Clininet

CVE-2025-30055

Conditional RCE via the "system" function

The "system" function receives untrusted input from the user. If the "EnableJSCaching" option is enabled, it is possible to execute arbitrary code provided as the "Module" parameter.

CVSS 4.0 · 9 Critical EPSS < 1% KEV · Not listed

Vendors

Cgm

Products

Clininet

CVE-2025-30056

Calling system commands via RunCommand

The RunCommand function accepts any parameter, which is then passed for execution in the shell. This allows an attacker to execute arbitrary code on the system.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Cgm

Products

Clininet

CVE-2025-30057

Authenticated RCE with uhcapache privileges in ConvertToPDF

In UHCRTFDoc, the filename parameter can be exploited to execute arbitrary code via command injection into the system() call in the ConvertToPDF function.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Cgm

Products

Clininet

CVE-2025-30058

SQL injection in getPatientIdentifier function of PatientService.pl

In the PatientService.pl service, the "getPatientIdentifier" function is vulnerable to SQL injection through the "pesel" parameter.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Cgm

Products

Clininet

CVE-2025-30042

Session generation possible with certificate number only

The CGM CLININET system provides smart card authentication; however, authentication is conducted locally on the client device, and, in reality, only the certificate number is used for access verification. As a result, possession of the certificate number alone is sufficient for authentication, regardless of the actual presence of the smart card or ownership of the private key.

CVSS 4.0 · 9 Critical EPSS < 1% KEV · Not listed

Vendors

Cgm

Products

Cgm Clininet Clininet

CVE-2025-58402

Insecure Direct Object Reference Message ID

The CGM CLININET application uses direct, sequential object identifiers "MessageID" without proper authorization checks. By modifying the parameter in the GET request, an attacker can access messages and attachments belonging to other users.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Cgm

Products

Cgm Clininet Clininet

CVE-2025-58405

Lack of protection mechanisms against Clickjacking attacks

The CGM CLININET application does not implement any mechanisms that prevent clickjacking attacks, neither HTTP security headers nor HTML-based frame‑busting protections were detected. As a result, an attacker can embed the application inside a maliciously crafted IFRAME and trick users into performing unintended actions, including potentially bypassing CSRF/XSRF defenses.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Cgm

Products

Cgm Clininet Clininet

CVE-2025-58406

Lack of HTTP Response Headers

The CGM CLININET application respond without essential security HTTP headers, exposing users to client‑side attacks such as clickjacking, MIME sniffing, unsafe caching, weak cross‑origin isolation, and missing transport security controls.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Cgm

Products

Cgm Clininet Clininet

CVE-2025-10350

SQL injection in CGM NETRAAD

SQL Injection vulnerability in "imageserver" module when processing C-FIND queries in CGM NETRAAD software allows attacker connected to PACS gaining access to database, including data processed by GCM CLININET software.This issue affects CGM NETRAAD with imageserver module in versions before 7.9.0.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Cgm

Products

Cgm Netraad

CVE-2025-30035

Lack of API authentication allowing session generation for any user

The vulnerability enables an attacker to fully bypass authentication in CGM CLININET and gain access to any active user account by supplying only the username, without requiring a password or any other credentials. Obtaining a session ID is sufficient for session takeover and grants access to the system with the privileges of the targeted user.

CVSS 4.0 · 9 Critical EPSS < 1% KEV · Not listed

Vendors

Cgm

Products

Cgm Clininet

CVE-2025-30044

RCE on uhcapache user permissions

In the endpoints "/cgi-bin/CliniNET.prd/utils/usrlogstat_simple.pl", "/cgi-bin/CliniNET.prd/utils/usrlogstat.pl", "/cgi-bin/CliniNET.prd/utils/userlogstat2.pl", and "/cgi-bin/CliniNET.prd/utils/dblogstat.pl", the parameters are not sufficiently normalized, which enables code injection.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Cgm

Products

Cgm Clininet

CVE-2025-30062

SQL injection in CheckUnitCodeAndKey.pl

In the "CheckUnitCodeAndKey.pl" service, the "validateOrgUnit" function is vulnerable to SQL injection.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Cgm

Products

Cgm Clininet