Search
Find a vulnerability
Search criteria
4 vulnerabilities found for Wingesfar by CompuGroup Medical
CVE-2026-118798 (GCVE-0-2026-118798)
Vulnerability from cvelistv5 – Published: 2026-11-09 12:05 – Updated: 2026-11-09 15:24
VLAI
EPSS
VEX
Title
Multiple sensitive authentication data exposed
Summary
Multiple sensitive authentication data, including credentials, OAuth-related secrets, session information, and authentication artifacts, are exposed through application logs and persistent client-side storage, enabling unauthorized access and session compromise.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 15:04 UTC
CWE
Assigner
ENISA
CNA
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| CompuGroup Medical | Wingesfar |
Affected:
0 , < 2026.07a
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-118798",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T15:04:43.118723Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T15:24:49.329Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Wingesfar",
"vendor": "CompuGroup Medical",
"versions": [
{
"lessThan": "2026.07a",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Marco Sala"
},
{
"lang": "en",
"type": "coordinator",
"value": "CSIRT-IT"
},
{
"lang": "en",
"type": "finder",
"value": "ApoCert srl"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eMultiple sensitive authentication data, including credentials, OAuth-related secrets, session information, and authentication artifacts, are exposed through application logs and persistent client-side storage, enabling unauthorized access and session compromise.\u003c/div\u003e"
}
],
"value": "Multiple sensitive authentication data, including credentials, OAuth-related secrets, session information, and authentication artifacts, are exposed through application logs and persistent client-side storage, enabling unauthorized access and session compromise."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:U",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-532",
"description": "CWE-532",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T12:05:28.065Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"url": "https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical"
},
{
"url": "https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Multiple sensitive authentication data exposed",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-118798",
"datePublished": "2026-11-09T12:05:28.065Z",
"dateReserved": "2026-10-28T19:54:01.399Z",
"dateUpdated": "2026-11-09T15:24:49.329Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118792 (GCVE-0-2026-118792)
Vulnerability from cvelistv5 – Published: 2026-11-09 12:04 – Updated: 2026-11-09 12:04
VLAI
EPSS
VEX
Title
Default ODBC credentials
Summary
Default credentials permit access through AcuXDBC.
Severity
CWE
Assigner
ENISA
CNA
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| CompuGroup Medical | Wingesfar |
Affected:
0 , < 2026.07a
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Wingesfar",
"vendor": "CompuGroup Medical",
"versions": [
{
"lessThan": "2026.07a",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Marco Sala"
},
{
"lang": "en",
"type": "coordinator",
"value": "CSIRT-IT"
},
{
"lang": "en",
"type": "finder",
"value": "ApoCert srl"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eDefault credentials permit access through AcuXDBC.\u003c/p\u003e"
}
],
"value": "Default credentials permit access through AcuXDBC."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1392",
"description": "CWE-1392",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T12:04:16.675Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"url": "https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical"
},
{
"url": "https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Default ODBC credentials",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-118792",
"datePublished": "2026-11-09T12:04:16.675Z",
"dateReserved": "2026-10-28T19:53:57.995Z",
"dateUpdated": "2026-11-09T12:04:16.675Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118791 (GCVE-0-2026-118791)
Vulnerability from cvelistv5 – Published: 2026-11-09 12:03 – Updated: 2026-11-09 12:03
VLAI
EPSS
VEX
Title
Insecure software update mechanism
Summary
The application implements software update functionality without adequate authenticity and integrity validation, allowing update packages to be accepted without sufficient cryptographic verification.
Severity
CWE
Assigner
ENISA
CNA
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| CompuGroup Medical | Wingesfar |
Affected:
0 , < 10.2.1
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Wingesfar",
"vendor": "CompuGroup Medical",
"versions": [
{
"lessThan": "10.2.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Marco Sala"
},
{
"lang": "en",
"type": "coordinator",
"value": "CSIRT-IT"
},
{
"lang": "en",
"type": "finder",
"value": "ApoCert srl"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eThe application implements software update functionality without adequate authenticity and integrity validation, allowing update packages to be accepted without sufficient cryptographic verification.\u003c/div\u003e"
}
],
"value": "The application implements software update functionality without adequate authenticity and integrity validation, allowing update packages to be accepted without sufficient cryptographic verification."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-494",
"description": "CWE-494",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T12:03:10.247Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"url": "https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical"
},
{
"url": "https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Insecure software update mechanism",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-118791",
"datePublished": "2026-11-09T12:03:10.247Z",
"dateReserved": "2026-10-28T19:53:57.995Z",
"dateUpdated": "2026-11-09T12:03:10.247Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118790 (GCVE-0-2026-118790)
Vulnerability from cvelistv5 – Published: 2026-11-09 12:02 – Updated: 2026-11-09 12:02
VLAI
EPSS
VEX
Title
Multiple Hardcoded Credentials
Summary
Multiple hardcoded credentials are embedded within product components and administrative functionalities. These credentials may enable unauthorized access to privileged accounts, services, or application features across affected deployments.
Severity
CWE
Assigner
ENISA
CNA
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| CompuGroup Medical | Wingesfar |
Affected:
0 , < 2026.07a
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Wingesfar",
"vendor": "CompuGroup Medical",
"versions": [
{
"lessThan": "2026.07a",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Marco Sala"
},
{
"lang": "en",
"type": "coordinator",
"value": "CSIRT-IT"
},
{
"lang": "en",
"type": "finder",
"value": "ApoCert srl"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eMultiple hardcoded credentials are embedded within product components and administrative functionalities. These credentials may enable unauthorized access to privileged accounts, services, or application features across affected deployments.\u003c/div\u003e"
}
],
"value": "Multiple hardcoded credentials are embedded within product components and administrative functionalities. These credentials may enable unauthorized access to privileged accounts, services, or application features across affected deployments."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "CWE-798",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T12:02:34.618Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"url": "https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical"
},
{
"url": "https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Multiple Hardcoded Credentials",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-118790",
"datePublished": "2026-11-09T12:02:34.618Z",
"dateReserved": "2026-10-28T19:53:57.995Z",
"dateUpdated": "2026-11-09T12:02:34.618Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}