PT-2026-22575 · Unknown · Cgm Clininet

Maciej Kazulak · CVE-2025-30044 · Published 2026-03-02 · Updated 2026-03-02

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Critical

Base vector

AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions CGM CLININET (affected versions not specified)

Description The application suffers from insufficient input normalization in several API endpoints, leading to potential code injection. Specifically, the parameters passed to the following endpoints are not adequately sanitized: '/cgi-bin/CliniNET.prd/utils/usrlogstat simple.pl', '/cgi-bin/CliniNET.prd/utils/usrlogstat.pl', '/cgi-bin/CliniNET.prd/utils/userlogstat2.pl', and '/cgi-bin/CliniNET.prd/utils/dblogstat.pl'. This allows for the execution of arbitrary code through crafted input.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-30044

Affected Products

Cgm Clininet

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-30044 · Security Note
• https://cgm.com/pol_pl/products/szpital/cgm-clininet.html · Note
• https://t.me/cveNotify/153712 · Telegram Post
• https://t.me/CVEtracker/46112 · Telegram Post
• https://twitter.com/vuldb/status/2028457442363990344 · Twitter Post
• https://twitter.com/CVEnew/status/2028437081304019055 · Twitter Post
• https://cert.pl/en/posts/2026/03/CVE-2025-10350 · Note