CGM XDent and XMedical expose PHP synchronization endpoints that allow unauthenticated attackers to manipulate session variables and execute…
CGM XDent and XMedical expose PHP synchronization endpoints that allow unauthenticated attackers to manipulate session variables and execute arbitrary SQL queries against backend MySQL databases.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- CompuGroup Medical
- Product
- XDent, XMedical
- CVSS v4.0
- 8.1 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:X
- Weakness
- CWE-89
- Exposure class
- Database
- NVD status
- Received
Why it ranks 36 (Notable)
- CVSS v4.0 8.1 high
- Product class: database
- Widely deployed vendor product (CompuGroup Medical)
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.