CVE-2025-58402

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The CGM CLININET application uses direct, sequential object identifiers "MessageID" without proper authorization checks. By modifying the parameter in the GET request, an attacker can access messages and attachments belonging to other users.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-639

Affected software

Vendor	Product	Versions
CGM	CGM CLININET	< 2025.MS4

References

https://cert.pl/en/posts/2026/03/CVE-2025-10350/Third Party Advisory
https://www.cgm.com/pol_pl/products/szpital/cgm-clininet.htmlProduct

Timeline

Published: Mar 2, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-584035.1CGM CLININET is vulnerable to Reflected Cross-Site Scripting (XSS) due to improper neutralization of user-supplied data. A remote unauthenti CVE-2025-584056.1The CGM CLININET application does not implement any mechanisms that prevent clickjacking attacks, neither HTTP security headers nor HTML-bas CVE-2025-584064.3The CGM CLININET application respond without essential security HTTP headers, exposing users to client‑side attacks such as clickjacking, MI CVE-2025-584077.4Kernel or driver software installed on a Guest VM may post improper commands to the GPU Firmware to exploit a TOCTOU race condition and trig CVE-2025-584085.9Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger reads of stale data that can lead to ke CVE-2025-584093.5Software installed and run as a non-privileged user may conduct improper GPU system calls to subvert GPU HW to write to arbitrary physical m CVE-2025-58416.4The ACF Onyx Poll plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class’ parameter in all versions up to, and inc CVE-2025-584107.5Software installed and run as a non-privileged user may conduct improper GPU system calls to gain write permissions to memory buffers export CVE-2025-584118.8Software installed and run as a non-privileged user may conduct improper GPU system calls to cause mismanagement of resources reference coun CVE-2025-584126.1A improper neutralization of script-related html tags in a web page (basic xss) vulnerability in Fortinet FortiADC 8.0.0, FortiADC 7.6.0 thr CVE-2025-584137.5A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, CVE-2025-58425.4The Modern Design Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class’ parameter in all versions up to,