Vulnerabilities in CGM
36 resultsCVE-2025-30037HIGHMissing authentication in APIs allowing data retrieval and modificationEPSS 0.2%CVE-2025-30062MEDIUMSQL injection in CheckUnitCodeAndKey.plEPSS 0.2%CVE-2025-30048MEDIUMUnauthenticated access to module configuration endpointEPSS 0.2%CVE-2025-10350HIGHSQL injection in CGM NETRAADEPSS 0.2%CVE-2025-58405MEDIUMLack of protection mechanisms against Clickjacking attacksEPSS 0.2%CVE-2025-30045HIGHCode Injection in CGM CLININETEPSS 0.2%CVE-2025-30040CRITICALMissing authentication in API returning request logs containing session IDsEPSS 0.2%CVE-2025-30039CRITICALMissing authentication in API returning a list of all active sessionsEPSS 0.2%CVE-2025-30041CRITICALMissing authentication in APIs returning statistical data along with session IDsEPSS 0.2%CVE-2025-30038HIGHSession ID leakage in Zone.Identifier of downloaded filesEPSS 0.2%CVE-2025-30036HIGHStored XSS permitting session takeover of arbitrary userEPSS 0.2%CVE-2025-30063CRITICALExcessive permissions on configuration files containing database logins and passwordsEPSS 0.1%CVE-2025-30054CRITICALLocal Privilege Escalation in CGM CLININETEPSS 0.1%CVE-2025-30042CRITICALSession generation possible with certificate number onlyEPSS 0.1%CVE-2025-30051MEDIUMInsecure File Permissions in CGM CLININETEPSS 0.1%CVE-2025-30064HIGHPossibility to generate a session for any user via the "ex:action" parameter after obtaining access to the JWT keyEPSS 0.1%