Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: CGM CLININET 2025.MS2 Clear all filters
TI-2025-21423 CVE-2025-30062 · GHSA-442r-f955-7j24

SQL injection in CheckUnitCodeAndKey.pl

Priority LOW 30

In the "CheckUnitCodeAndKey.pl" service, the "validateOrgUnit" function is vulnerable to SQL injection.

CVSS 4.0MEDIUM 6.9 Adjacent network Low privileges No interaction EPSS 0.00205 Published 2026-03-02 Fixed in 2025.MS2 CWE-89
TI-2025-21414 CVE-2025-30044 · GHSA-g323-8g66-2v63

RCE on uhcapache user permissions

Priority MEDIUM 43

In the endpoints "/cgi-bin/CliniNET.prd/utils/usrlogstat_simple.pl", "/cgi-bin/CliniNET.prd/utils/usrlogstat.pl", "/cgi-bin/CliniNET.prd/utils/userlogstat2.pl", and "/cgi-bin/CliniNET.prd/utils/dblogstat.pl", the paramet…

CVSS 4.0CRITICAL 9.4 Adjacent network No auth No interaction EPSS 0.00588 Published 2026-03-02 Fixed in 2025.MS2 CWE-78
TI-2025-21413 CVE-2025-30042 · GHSA-rfwf-h4fr-xr3g

Session generation possible with certificate number only

Priority MEDIUM 40

The CGM CLININET system provides smart card authentication; however, authentication is conducted locally on the client device, and, in reality, only the certificate number is used for access verification.

CVSS 4.0CRITICAL 9.0 Adjacent network No auth No interaction EPSS 0.00099 Published 2026-03-02 Fixed in 2025.MS2 CWE-603