PT-2026-22575 · Unknown · Cgm Clininet

Maciej Kazulak · Publicado 2026-03-02 · Atualizado 2026-03-02 · CVE-2025-30044

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Crítica

Vetor base

AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions CGM CLININET (affected versions not specified)

Description The application suffers from insufficient input normalization in several API endpoints, leading to potential code injection. Specifically, the parameters passed to the following endpoints are not adequately sanitized: '/cgi-bin/CliniNET.prd/utils/usrlogstat simple.pl', '/cgi-bin/CliniNET.prd/utils/usrlogstat.pl', '/cgi-bin/CliniNET.prd/utils/userlogstat2.pl', and '/cgi-bin/CliniNET.prd/utils/dblogstat.pl'. This allows for the execution of arbitrary code through crafted input.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2025-30044

Produtos afetados

Cgm Clininet

Referências · 7

• https://cgm.com/pol_pl/products/szpital/cgm-clininet.html · Nota
• https://t.me/cveNotify/153712 · Publicação no Telegram
• https://t.me/CVEtracker/46112 · Publicação no Telegram
• https://twitter.com/vuldb/status/2028457442363990344 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2028437081304019055 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-30044 · Nota de Segurança
• https://cert.pl/en/posts/2026/03/CVE-2025-10350 · Nota