CVE-2025-30048

Unauthenticated access to module configuration endpoint

The "serverConfig" endpoint, which returns the module configuration including credentials, is accessible without authentication.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Cgm

Products

Clininet

CVE-2025-30036

Stored XSS permitting session takeover of arbitrary user

Stored XSS vulnerability exists in the "Oddział" (Ward) module, in the death diagnosis description field, and allows the execution of arbitrary JavaScript code. This can lead to session hijacking of other users and potentially to privilege escalation up to full administrative rights.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Cgm

Products

Clininet

CVE-2025-30037

Missing authentication in APIs allowing data retrieval and modification

The system exposes several endpoints, typically including "/int/" in their path, that should be restricted to internal services, but are instead publicly accessible without authentication to any host able to reach the application server on port 443/tcp.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Cgm

Products

Clininet

CVE-2025-30039

Missing authentication in API returning a list of all active sessions

Unauthenticated access to the "/cgi-bin/CliniNET.prd/GetActiveSessions.pl" endpoint allows takeover of any user session logged into the system, including users with admin privileges.

CVSS 4.0 · 9 Critical EPSS < 1% KEV · Not listed

Vendors

Cgm

Products

Clininet

CVE-2025-30040

Missing authentication in API returning request logs containing session IDs

The vulnerability allows unauthenticated users to download a file containing session ID data by directly accessing the "/cgi-bin/CliniNET.prd/utils/userlogxls.pl" endpoint.

CVSS 4.0 · 9 Critical EPSS < 1% KEV · Not listed

Vendors

Cgm

Products

Clininet

CVE-2025-30041

Missing authentication in APIs returning statistical data along with session IDs

The paths "/cgi-bin/CliniNET.prd/utils/userlogstat.pl", "/cgi-bin/CliniNET.prd/utils/usrlogstat.pl", and "/cgi-bin/CliniNET.prd/utils/dblogstat.pl" expose data containing session IDs.

CVSS 4.0 · 9 Critical EPSS < 1% KEV · Not listed

Vendors

Cgm

Products

Clininet

CVE-2025-30058

SQL injection in getPatientIdentifier function of PatientService.pl

In the PatientService.pl service, the "getPatientIdentifier" function is vulnerable to SQL injection through the "pesel" parameter.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Cgm

Products

Clininet

CVE-2025-30060

SQL injection in ReturnUserUnitsXML.pl via the UserID parameter

In the ReturnUserUnitsXML.pl service, the "getUserInfo" function is vulnerable to SQL injection through the "UserID" parameter.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Cgm

Products

Clininet

CVE-2025-30061

SQL injection in utils/Reporter/OpenReportWindow.pl via the UserID parameter

In the "utils/Reporter/OpenReportWindow.pl" service, there is an SQL injection vulnerability through the "UserID" parameter.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Cgm

Products

Clininet

CVE-2025-30064

Possibility to generate a session for any user via the "ex:action" parameter after obtaining access to the JWT key

An insufficiently secured internal function allows session generation for arbitrary users. The decodeParam function checks the JWT but does not verify which signing algorithm was used. As a result, an attacker can use the "ex:action" parameter in the VerifyUserByThrustedService function to generate a session for any user.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Cgm

Products

Clininet

CVE-2025-30055

Conditional RCE via the "system" function

The "system" function receives untrusted input from the user. If the "EnableJSCaching" option is enabled, it is possible to execute arbitrary code provided as the "Module" parameter.

CVSS 4.0 · 9 Critical EPSS < 1% KEV · Not listed

Vendors

Cgm

Products

Clininet

CVE-2025-30056

Calling system commands via RunCommand

The RunCommand function accepts any parameter, which is then passed for execution in the shell. This allows an attacker to execute arbitrary code on the system.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Cgm

Products

Clininet

CVE-2025-30057

Authenticated RCE with uhcapache privileges in ConvertToPDF

In UHCRTFDoc, the filename parameter can be exploited to execute arbitrary code via command injection into the system() call in the ConvertToPDF function.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Cgm

Products

Clininet

CVE-2025-30042

Session generation possible with certificate number only

The CGM CLININET system provides smart card authentication; however, authentication is conducted locally on the client device, and, in reality, only the certificate number is used for access verification. As a result, possession of the certificate number alone is sufficient for authentication, regardless of the actual presence of the smart card or ownership of the private key.

CVSS 4.0 · 9 Critical EPSS < 1% KEV · Not listed

Vendors

Cgm

Products

Cgm Clininet Clininet

CVE-2025-58402

Insecure Direct Object Reference Message ID

The CGM CLININET application uses direct, sequential object identifiers "MessageID" without proper authorization checks. By modifying the parameter in the GET request, an attacker can access messages and attachments belonging to other users.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Cgm

Products

Cgm Clininet Clininet

CVE-2025-58405

Lack of protection mechanisms against Clickjacking attacks

The CGM CLININET application does not implement any mechanisms that prevent clickjacking attacks, neither HTTP security headers nor HTML-based frame‑busting protections were detected. As a result, an attacker can embed the application inside a maliciously crafted IFRAME and trick users into performing unintended actions, including potentially bypassing CSRF/XSRF defenses.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Cgm

Products

Cgm Clininet Clininet

CVE-2025-58406

Lack of HTTP Response Headers

The CGM CLININET application respond without essential security HTTP headers, exposing users to client‑side attacks such as clickjacking, MIME sniffing, unsafe caching, weak cross‑origin isolation, and missing transport security controls.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Cgm

Products

Cgm Clininet Clininet