CVE-2025-30051

MediumCVSS 6.8/10Last modified Oct 23, 2026

Description

The CGM CLININET application stores the production database login and password, as well as RabbitMQ broker credentials, in the SysIO.pl configuration file. Insecure file permissions make this file readable by any local account. 

This issue was fixed in version 2026.MS3

Metrics

CVSS 4.0 6.8/10CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-732

Affected software

No affected versions have been published.

Timeline

Published
Oct 23, 2026
Last modified
Oct 23, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-300528.8The rsyncd service of the CGM CLININET is vulnerable to Authentication Bypass via IP spoofing. Access is granted based solely on the client'CVE-2025-300536.9The CGM CLININET application runs the cgm-updater process listening on an open network port without any authentication. The vulnerabilitCVE-2025-300549.3CGM CLININET is vulnerable to local privilege escalation. The service that processes incoming HL7 messages runs with root privileges, but duCVE-2025-300559.0The "system" function receives untrusted input from the user. If the "EnableJSCaching" option is enabled, it is possible to execute arbitrarCVE-2025-300569.4The RunCommand function accepts any parameter, which is then passed for execution in the shell. This allows an attacker to execute arbitraryCVE-2025-300579.4In UHCRTFDoc, the filename parameter can be exploited to execute arbitrary code via command injection into the system() call in the ConvertTCVE-2025-300586.9In the PatientService.pl service, the "getPatientIdentifier" function is vulnerable to SQL injection through the "pesel" parameter.CVE-2025-300596.9In the PrepareCDExportJSON.pl service, the "getPerfServiceIds" function is vulnerable to SQL injection.CVE-2025-30069.8A vulnerability was found in PHPGurukul e-Diary Management System 1.0. It has been declared as critical. This vulnerability affects unknown CVE-2025-300606.9In the ReturnUserUnitsXML.pl service, the "getUserInfo" function is vulnerable to SQL injection through the "UserID" parameter.CVE-2025-300616.9In the "utils/Reporter/OpenReportWindow.pl" service, there is an SQL injection vulnerability through the "UserID" parameter.CVE-2025-300626.9In the "CheckUnitCodeAndKey.pl" service, the "validateOrgUnit" function is vulnerable to SQL injection.