Find a vulnerability

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

1 vulnerability found for XMedical by CompuGroup Medical

CVE-2026-112172 (GCVE-0-2026-112172)

Vulnerability from cvelistv5 – Published: 2026-11-09 11:38 – Updated: 2026-11-09 11:45

Title

Unauthenticated SQL Execution in XDent/XMedical Synchronization Infrastructure

Summary

CGM XDent and XMedical expose PHP synchronization endpoints that allow unauthenticated attackers to manipulate session variables and execute arbitrary SQL queries against backend MySQL databases.

Severity

8.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:Y

CWE

CWE-89 - Improper neutralization of special elements used in an SQL command ('SQL injection')

Assigner

ENISA CNA

References

2 references

URL	Tags
https://www.acn.gov.it/portale/w/rilevate-vulnera…	government-resource
https://www.cgm.com/ita_it/magazine/articles/comu…	government-resource

Impacted products

2 products

Vendor	Product	Version
CompuGroup Medical	XDent	Affected: 0 , < 4.4.0 (semver)
CompuGroup Medical	XMedical	Affected: 0 , < 4.4.0 (semver)

Credits

Marco Sala CSIRT-IT ApoCert srl

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "XDent",
          "vendor": "CompuGroup Medical",
          "versions": [
            {
              "lessThan": "4.4.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "XMedical",
          "vendor": "CompuGroup Medical",
          "versions": [
            {
              "lessThan": "4.4.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Marco Sala"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "CSIRT-IT"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "ApoCert srl"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "CGM XDent and XMedical expose PHP synchronization endpoints that allow unauthenticated attackers to manipulate session variables and execute arbitrary SQL queries against backend MySQL databases."
            }
          ],
          "value": "CGM XDent and XMedical expose PHP synchronization endpoints that allow unauthenticated attackers to manipulate session variables and execute arbitrary SQL queries against backend MySQL databases."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "YES",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "exploitMaturity": "UNREPORTED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:Y",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 Improper neutralization of special elements used in an SQL command (\u0027SQL injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T11:45:11.226Z",
        "orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
        "shortName": "ENISA"
      },
      "references": [
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical"
        },
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html"
        }
      ],
      "title": "Unauthenticated SQL Execution in XDent/XMedical Synchronization Infrastructure",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
    "assignerShortName": "ENISA",
    "cveId": "CVE-2026-112172",
    "datePublished": "2026-11-09T11:38:18.744Z",
    "dateReserved": "2026-10-19T08:06:39.208Z",
    "dateUpdated": "2026-11-09T11:45:11.226Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}