Search
Find a vulnerability
Search criteria
17 vulnerabilities by CompuGroup Medical
CVE-2026-118798 (GCVE-0-2026-118798)
Vulnerability from cvelistv5 – Published: 2026-11-09 12:05 – Updated: 2026-11-09 15:24
VLAI
EPSS
VEX
Title
Multiple sensitive authentication data exposed
Summary
Multiple sensitive authentication data, including credentials, OAuth-related secrets, session information, and authentication artifacts, are exposed through application logs and persistent client-side storage, enabling unauthorized access and session compromise.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 15:04 UTC
CWE
Assigner
ENISA
CNA
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| CompuGroup Medical | Wingesfar |
Affected:
0 , < 2026.07a
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-118798",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T15:04:43.118723Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T15:24:49.329Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Wingesfar",
"vendor": "CompuGroup Medical",
"versions": [
{
"lessThan": "2026.07a",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Marco Sala"
},
{
"lang": "en",
"type": "coordinator",
"value": "CSIRT-IT"
},
{
"lang": "en",
"type": "finder",
"value": "ApoCert srl"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eMultiple sensitive authentication data, including credentials, OAuth-related secrets, session information, and authentication artifacts, are exposed through application logs and persistent client-side storage, enabling unauthorized access and session compromise.\u003c/div\u003e"
}
],
"value": "Multiple sensitive authentication data, including credentials, OAuth-related secrets, session information, and authentication artifacts, are exposed through application logs and persistent client-side storage, enabling unauthorized access and session compromise."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:U",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-532",
"description": "CWE-532",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T12:05:28.065Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"url": "https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical"
},
{
"url": "https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Multiple sensitive authentication data exposed",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-118798",
"datePublished": "2026-11-09T12:05:28.065Z",
"dateReserved": "2026-10-28T19:54:01.399Z",
"dateUpdated": "2026-11-09T15:24:49.329Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118795 (GCVE-0-2026-118795)
Vulnerability from cvelistv5 – Published: 2026-11-09 12:04 – Updated: 2026-11-09 15:25
VLAI
EPSS
VEX
Title
AIS stores authorization state in locally modifiable databases
Summary
Administrative roles and module permissions are stored in mutable local database fields, allowing privilege escalation for attackers with database write access.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 15:04 UTC
CWE
Assigner
ENISA
CNA
References
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| CompuGroup Medical | Infantia |
Affected:
0 , ≤ 6.09.1
(semver)
|
|
| CompuGroup Medical | Profim |
Affected:
0 , ≤ 6.09.1
(semver)
|
|
| CompuGroup Medical | Venere |
Affected:
0 , ≤ 8.33.2
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-118795",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T15:04:53.696870Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T15:25:06.888Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Infantia",
"vendor": "CompuGroup Medical",
"versions": [
{
"lessThanOrEqual": "6.09.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Profim",
"vendor": "CompuGroup Medical",
"versions": [
{
"lessThanOrEqual": "6.09.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Venere",
"vendor": "CompuGroup Medical",
"versions": [
{
"lessThanOrEqual": "8.33.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Marco Sala"
},
{
"lang": "en",
"type": "coordinator",
"value": "CSIRT-IT"
},
{
"lang": "en",
"type": "finder",
"value": "ApoCert srl"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Administrative roles and module permissions are stored in mutable local database fields, allowing privilege escalation for attackers with database write access."
}
],
"value": "Administrative roles and module permissions are stored in mutable local database fields, allowing privilege escalation for attackers with database write access."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-602",
"description": "CWE-602",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T12:04:53.081Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"url": "https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical"
},
{
"url": "https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "AIS stores authorization state in locally modifiable databases",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-118795",
"datePublished": "2026-11-09T12:04:53.081Z",
"dateReserved": "2026-10-28T19:54:01.399Z",
"dateUpdated": "2026-11-09T15:25:06.888Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118792 (GCVE-0-2026-118792)
Vulnerability from cvelistv5 – Published: 2026-11-09 12:04 – Updated: 2026-11-09 12:04
VLAI
EPSS
VEX
Title
Default ODBC credentials
Summary
Default credentials permit access through AcuXDBC.
Severity
CWE
Assigner
ENISA
CNA
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| CompuGroup Medical | Wingesfar |
Affected:
0 , < 2026.07a
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Wingesfar",
"vendor": "CompuGroup Medical",
"versions": [
{
"lessThan": "2026.07a",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Marco Sala"
},
{
"lang": "en",
"type": "coordinator",
"value": "CSIRT-IT"
},
{
"lang": "en",
"type": "finder",
"value": "ApoCert srl"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eDefault credentials permit access through AcuXDBC.\u003c/p\u003e"
}
],
"value": "Default credentials permit access through AcuXDBC."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1392",
"description": "CWE-1392",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T12:04:16.675Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"url": "https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical"
},
{
"url": "https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Default ODBC credentials",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-118792",
"datePublished": "2026-11-09T12:04:16.675Z",
"dateReserved": "2026-10-28T19:53:57.995Z",
"dateUpdated": "2026-11-09T12:04:16.675Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118791 (GCVE-0-2026-118791)
Vulnerability from cvelistv5 – Published: 2026-11-09 12:03 – Updated: 2026-11-09 12:03
VLAI
EPSS
VEX
Title
Insecure software update mechanism
Summary
The application implements software update functionality without adequate authenticity and integrity validation, allowing update packages to be accepted without sufficient cryptographic verification.
Severity
CWE
Assigner
ENISA
CNA
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| CompuGroup Medical | Wingesfar |
Affected:
0 , < 10.2.1
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Wingesfar",
"vendor": "CompuGroup Medical",
"versions": [
{
"lessThan": "10.2.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Marco Sala"
},
{
"lang": "en",
"type": "coordinator",
"value": "CSIRT-IT"
},
{
"lang": "en",
"type": "finder",
"value": "ApoCert srl"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eThe application implements software update functionality without adequate authenticity and integrity validation, allowing update packages to be accepted without sufficient cryptographic verification.\u003c/div\u003e"
}
],
"value": "The application implements software update functionality without adequate authenticity and integrity validation, allowing update packages to be accepted without sufficient cryptographic verification."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-494",
"description": "CWE-494",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T12:03:10.247Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"url": "https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical"
},
{
"url": "https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Insecure software update mechanism",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-118791",
"datePublished": "2026-11-09T12:03:10.247Z",
"dateReserved": "2026-10-28T19:53:57.995Z",
"dateUpdated": "2026-11-09T12:03:10.247Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118790 (GCVE-0-2026-118790)
Vulnerability from cvelistv5 – Published: 2026-11-09 12:02 – Updated: 2026-11-09 12:02
VLAI
EPSS
VEX
Title
Multiple Hardcoded Credentials
Summary
Multiple hardcoded credentials are embedded within product components and administrative functionalities. These credentials may enable unauthorized access to privileged accounts, services, or application features across affected deployments.
Severity
CWE
Assigner
ENISA
CNA
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| CompuGroup Medical | Wingesfar |
Affected:
0 , < 2026.07a
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Wingesfar",
"vendor": "CompuGroup Medical",
"versions": [
{
"lessThan": "2026.07a",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Marco Sala"
},
{
"lang": "en",
"type": "coordinator",
"value": "CSIRT-IT"
},
{
"lang": "en",
"type": "finder",
"value": "ApoCert srl"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eMultiple hardcoded credentials are embedded within product components and administrative functionalities. These credentials may enable unauthorized access to privileged accounts, services, or application features across affected deployments.\u003c/div\u003e"
}
],
"value": "Multiple hardcoded credentials are embedded within product components and administrative functionalities. These credentials may enable unauthorized access to privileged accounts, services, or application features across affected deployments."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "CWE-798",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T12:02:34.618Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"url": "https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical"
},
{
"url": "https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Multiple Hardcoded Credentials",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-118790",
"datePublished": "2026-11-09T12:02:34.618Z",
"dateReserved": "2026-10-28T19:53:57.995Z",
"dateUpdated": "2026-11-09T12:02:34.618Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118468 (GCVE-0-2026-118468)
Vulnerability from cvelistv5 – Published: 2026-11-09 11:58 – Updated: 2026-11-09 11:58
VLAI
EPSS
VEX
Title
AIS XML parsers allow external entity resolution
Summary
XML parsers process attacker-influenced update manifests or network responses with external entity resolution enabled, potentially allowing XML External Entity (XXE) attacks.
Severity
CWE
Assigner
ENISA
CNA
References
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| CompuGroup Medical | Infantia |
Affected:
0 , ≤ 6.01.1
(semver)
|
|
| CompuGroup Medical | Profim |
Affected:
0 , ≤ 6.01.1
(semver)
|
|
| CompuGroup Medical | Phronesis |
Affected:
0 , ≤ 4.51.0
(semver)
|
|
| CompuGroup Medical | Venere |
Affected:
0 , ≤ 8.33.2
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Infantia",
"vendor": "CompuGroup Medical",
"versions": [
{
"lessThanOrEqual": "6.01.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Profim",
"vendor": "CompuGroup Medical",
"versions": [
{
"lessThanOrEqual": "6.01.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Phronesis",
"vendor": "CompuGroup Medical",
"versions": [
{
"lessThanOrEqual": "4.51.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Venere",
"vendor": "CompuGroup Medical",
"versions": [
{
"lessThanOrEqual": "8.33.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Marco Sala"
},
{
"lang": "en",
"type": "coordinator",
"value": "CSIRT-IT"
},
{
"lang": "en",
"type": "finder",
"value": "ApoCert srl"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "XML parsers process attacker-influenced update manifests or network responses with external entity resolution enabled, potentially allowing XML External Entity (XXE) attacks."
}
],
"value": "XML parsers process attacker-influenced update manifests or network responses with external entity resolution enabled, potentially allowing XML External Entity (XXE) attacks."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-611",
"description": "CWE-611",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T11:58:12.438Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"url": "https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical"
},
{
"url": "https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "AIS XML parsers allow external entity resolution",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-118468",
"datePublished": "2026-11-09T11:58:12.438Z",
"dateReserved": "2026-10-28T08:46:25.411Z",
"dateUpdated": "2026-11-09T11:58:12.438Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118467 (GCVE-0-2026-118467)
Vulnerability from cvelistv5 – Published: 2026-11-09 11:56 – Updated: 2026-11-09 11:56
VLAI
EPSS
VEX
Title
AIS products expose clinical and personal data via logs and telemetry
Summary
Shared telemetry and logging components store or transmit patient and doctor identifiers, clinical information, and low-entropy identifiers without adequate pseudonymization or protection.
Severity
CWE
Assigner
ENISA
CNA
References
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| CompuGroup Medical | Infantia |
Affected:
0 , ≤ 1.3.1
(semver)
|
|
| CompuGroup Medical | Profim |
Affected:
0 , ≤ 1.3.1
(semver)
|
|
| CompuGroup Medical | Venere |
Affected:
0 , ≤ 1.3.1
(semver)
|
|
| CompuGroup Medical | Phronesis |
Affected:
0 , ≤ 1.3.1
(semver)
|
|
| CompuGroup Medical | Infantia |
Affected:
0 , ≤ 5.1.1
(semver)
|
|
| CompuGroup Medical | Profim |
Affected:
0 , ≤ 5.1.1
(semver)
|
|
| CompuGroup Medical | Venere |
Affected:
0 , ≤ 5.1.1
(semver)
|
|
| CompuGroup Medical | Phronesis |
Affected:
0 , ≤ 5.1.1
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"packageName": "ImxTracing",
"product": "Infantia",
"vendor": "CompuGroup Medical",
"versions": [
{
"lessThanOrEqual": "1.3.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "ImxTracing",
"product": "Profim",
"vendor": "CompuGroup Medical",
"versions": [
{
"lessThanOrEqual": "1.3.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "ImxTracing",
"product": "Venere",
"vendor": "CompuGroup Medical",
"versions": [
{
"lessThanOrEqual": "1.3.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "ImxTracing",
"product": "Phronesis",
"vendor": "CompuGroup Medical",
"versions": [
{
"lessThanOrEqual": "1.3.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "cgm.it.ais.common",
"product": "Infantia",
"vendor": "CompuGroup Medical",
"versions": [
{
"lessThanOrEqual": "5.1.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "cgm.it.ais.common",
"product": "Profim",
"vendor": "CompuGroup Medical",
"versions": [
{
"lessThanOrEqual": "5.1.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "cgm.it.ais.common",
"product": "Venere",
"vendor": "CompuGroup Medical",
"versions": [
{
"lessThanOrEqual": "5.1.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "cgm.it.ais.common",
"product": "Phronesis",
"vendor": "CompuGroup Medical",
"versions": [
{
"lessThanOrEqual": "5.1.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Marco Sala"
},
{
"lang": "en",
"type": "coordinator",
"value": "CSIRT-IT"
},
{
"lang": "en",
"type": "finder",
"value": "ApoCert srl"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eShared telemetry and logging components store or transmit patient and doctor identifiers, clinical information, and low-entropy identifiers without adequate pseudonymization or protection.\u003c/div\u003e"
}
],
"value": "Shared telemetry and logging components store or transmit patient and doctor identifiers, clinical information, and low-entropy identifiers without adequate pseudonymization or protection."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-532",
"description": "CWE-532",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T11:56:43.635Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"url": "https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical"
},
{
"url": "https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "AIS products expose clinical and personal data via logs and telemetry",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-118467",
"datePublished": "2026-11-09T11:56:43.635Z",
"dateReserved": "2026-10-28T08:46:25.411Z",
"dateUpdated": "2026-11-09T11:56:43.635Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118465 (GCVE-0-2026-118465)
Vulnerability from cvelistv5 – Published: 2026-11-09 11:53 – Updated: 2026-11-09 11:53
VLAI
EPSS
VEX
Title
AIS products use vendor-wide hard-coded database credentials
Summary
Shared components expose hard-coded Access, workgroup, CCBasic, DBISAM, and related database credentials that are identical across installations.
Severity
CWE
Assigner
ENISA
CNA
References
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| CompuGroup Medical | Infantia |
Affected:
0 , ≤ 5.1.1
(semver)
|
|
| CompuGroup Medical | Profim |
Affected:
0 , ≤ 5.1.1
(semver)
|
|
| CompuGroup Medical | Venere |
Affected:
0 , ≤ 5.1.1
(semver)
|
|
| CompuGroup Medical | Phronesis |
Affected:
0 , ≤ 5.1.1
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"packageName": "cgm.it.ais.common",
"product": "Infantia",
"vendor": "CompuGroup Medical",
"versions": [
{
"lessThanOrEqual": "5.1.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "cgm.it.ais.common",
"product": "Profim",
"vendor": "CompuGroup Medical",
"versions": [
{
"lessThanOrEqual": "5.1.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "cgm.it.ais.common",
"product": "Venere",
"vendor": "CompuGroup Medical",
"versions": [
{
"lessThanOrEqual": "5.1.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "cgm.it.ais.common",
"product": "Phronesis",
"vendor": "CompuGroup Medical",
"versions": [
{
"lessThanOrEqual": "5.1.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Marco Sala"
},
{
"lang": "en",
"type": "coordinator",
"value": "CSIRT-IT"
},
{
"lang": "en",
"type": "finder",
"value": "ApoCert srl"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Shared components expose hard-coded Access, workgroup, CCBasic, DBISAM, and related database credentials that are identical across installations."
}
],
"value": "Shared components expose hard-coded Access, workgroup, CCBasic, DBISAM, and related database credentials that are identical across installations."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 5.8,
"baseSeverity": "MEDIUM",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "CWE-798",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T11:53:06.273Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"url": "https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical"
},
{
"url": "https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "AIS products use vendor-wide hard-coded database credentials",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-118465",
"datePublished": "2026-11-09T11:53:06.273Z",
"dateReserved": "2026-10-28T08:46:25.411Z",
"dateUpdated": "2026-11-09T11:53:06.273Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118464 (GCVE-0-2026-118464)
Vulnerability from cvelistv5 – Published: 2026-11-09 11:52 – Updated: 2026-11-09 11:52
VLAI
EPSS
VEX
Title
AIS shared cryptographic services use fixed cryptographic secrets
Summary
Shared cryptographic services use fixed vendor-wide secrets, deterministic IVs, null salts, and reversible transformations to protect credentials, IPC data, configuration values, and clinical fields.
Severity
CWE
Assigner
ENISA
CNA
References
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| CompuGroup Medical | Infantia |
Affected:
0 , ≤ 5.1.1
(semver)
|
|
| CompuGroup Medical | Profim |
Affected:
0 , ≤ 5.1.1
(semver)
|
|
| CompuGroup Medical | Venere |
Affected:
0 , ≤ 5.1.1
(semver)
|
|
| CompuGroup Medical | Phronesis |
Affected:
0 , ≤ 5.1.1
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"packageName": "cgm.it.ais.common",
"product": "Infantia",
"vendor": "CompuGroup Medical",
"versions": [
{
"lessThanOrEqual": "5.1.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "cgm.it.ais.common",
"product": "Profim",
"vendor": "CompuGroup Medical",
"versions": [
{
"lessThanOrEqual": "5.1.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "cgm.it.ais.common",
"product": "Venere",
"vendor": "CompuGroup Medical",
"versions": [
{
"lessThanOrEqual": "5.1.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "cgm.it.ais.common",
"product": "Phronesis",
"vendor": "CompuGroup Medical",
"versions": [
{
"lessThanOrEqual": "5.1.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Marco Sala"
},
{
"lang": "en",
"type": "coordinator",
"value": "CSIRT-IT"
},
{
"lang": "en",
"type": "finder",
"value": "ApoCert srl"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Shared cryptographic services use fixed vendor-wide secrets, deterministic IVs, null salts, and reversible transformations to protect credentials, IPC data, configuration values, and clinical fields."
}
],
"value": "Shared cryptographic services use fixed vendor-wide secrets, deterministic IVs, null salts, and reversible transformations to protect credentials, IPC data, configuration values, and clinical fields."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 5.8,
"baseSeverity": "MEDIUM",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-321",
"description": "CWE-321",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T11:52:32.717Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"url": "https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical"
},
{
"url": "https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "AIS shared cryptographic services use fixed cryptographic secrets",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-118464",
"datePublished": "2026-11-09T11:52:32.717Z",
"dateReserved": "2026-10-28T08:46:25.411Z",
"dateUpdated": "2026-11-09T11:52:32.717Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118462 (GCVE-0-2026-118462)
Vulnerability from cvelistv5 – Published: 2026-11-09 11:51 – Updated: 2026-11-09 11:51
VLAI
EPSS
VEX
Title
AIS update mechanism executes unverified code
Summary
Update components download and execute code without proper authenticity verification, relying on ignored hashes or forgeable checksums. Some update paths also permit archive traversal or script execution.
Severity
CWE
Assigner
ENISA
CNA
References
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| CompuGroup Medical | Infantia |
Affected:
0 , ≤ 1.3.0
(semver)
|
|
| CompuGroup Medical | Profim |
Affected:
0 , ≤ 1.3.0
(semver)
|
|
| CompuGroup Medical | Venere |
Affected:
0 , ≤ 1.3.0
(semver)
|
|
| CompuGroup Medical | Phronesis |
Affected:
0 , ≤ 1.3.0
(semver)
|
|
| CompuGroup Medical | Infantia |
Affected:
0 , ≤ 2.12.0
(semver)
|
|
| CompuGroup Medical | Profim |
Affected:
0 , ≤ 2.12.0
(semver)
|
|
| CompuGroup Medical | Venere |
Affected:
0 , ≤ 2.12.0
(semver)
|
|
| CompuGroup Medical | Phronesis |
Affected:
0 , ≤ 2.12.0
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"packageName": "cgm.files.delivery",
"product": "Infantia",
"vendor": "CompuGroup Medical",
"versions": [
{
"lessThanOrEqual": "1.3.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "cgm.files.delivery",
"product": "Profim",
"vendor": "CompuGroup Medical",
"versions": [
{
"lessThanOrEqual": "1.3.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "cgm.files.delivery",
"product": "Venere",
"vendor": "CompuGroup Medical",
"versions": [
{
"lessThanOrEqual": "1.3.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "cgm.files.delivery",
"product": "Phronesis",
"vendor": "CompuGroup Medical",
"versions": [
{
"lessThanOrEqual": "1.3.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "cgm.liveupdates",
"product": "Infantia",
"vendor": "CompuGroup Medical",
"versions": [
{
"lessThanOrEqual": "2.12.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "cgm.liveupdates",
"product": "Profim",
"vendor": "CompuGroup Medical",
"versions": [
{
"lessThanOrEqual": "2.12.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "cgm.liveupdates",
"product": "Venere",
"vendor": "CompuGroup Medical",
"versions": [
{
"lessThanOrEqual": "2.12.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "cgm.liveupdates",
"product": "Phronesis",
"vendor": "CompuGroup Medical",
"versions": [
{
"lessThanOrEqual": "2.12.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Marco Sala"
},
{
"lang": "en",
"type": "coordinator",
"value": "CSIRT-IT"
},
{
"lang": "en",
"type": "finder",
"value": "ApoCert srl"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update components download and execute code without proper authenticity verification, relying on ignored hashes or forgeable checksums. Some update paths also permit archive traversal or script execution."
}
],
"value": "Update components download and execute code without proper authenticity verification, relying on ignored hashes or forgeable checksums. Some update paths also permit archive traversal or script execution."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-494",
"description": "CWE-494",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T11:51:58.643Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"url": "https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical"
},
{
"url": "https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "AIS update mechanism executes unverified code",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-118462",
"datePublished": "2026-11-09T11:51:58.643Z",
"dateReserved": "2026-10-28T08:46:25.411Z",
"dateUpdated": "2026-11-09T11:51:58.643Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118461 (GCVE-0-2026-118461)
Vulnerability from cvelistv5 – Published: 2026-11-09 11:49 – Updated: 2026-11-09 11:49
VLAI
EPSS
VEX
Title
AIS PersonnelService client performs unauthenticated doctor-specific operations
Summary
The shared client accepts caller-controlled doctor identifiers for read and write operations without requiring authentication or authorization credentials.
Severity
CWE
Assigner
ENISA
CNA
References
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| CompuGroup Medical | Infantia |
Affected:
0 , ≤ 1.10.0
(semver)
|
|
| CompuGroup Medical | Profim |
Affected:
0 , ≤ 1.10.0
(semver)
|
|
| CompuGroup Medical | Venere |
Affected:
0 , ≤ 1.10.0
(semver)
|
|
| CompuGroup Medical | Phronesis |
Affected:
0 , ≤ 1.10.0
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"packageName": "cgm.it.ais.connector",
"product": "Infantia",
"vendor": "CompuGroup Medical",
"versions": [
{
"lessThanOrEqual": "1.10.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "cgm.it.ais.connector",
"product": "Profim",
"vendor": "CompuGroup Medical",
"versions": [
{
"lessThanOrEqual": "1.10.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "cgm.it.ais.connector",
"product": "Venere",
"vendor": "CompuGroup Medical",
"versions": [
{
"lessThanOrEqual": "1.10.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "cgm.it.ais.connector",
"product": "Phronesis",
"vendor": "CompuGroup Medical",
"versions": [
{
"lessThanOrEqual": "1.10.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Marco Sala"
},
{
"lang": "en",
"type": "coordinator",
"value": "CSIRT-IT"
},
{
"lang": "en",
"type": "finder",
"value": "ApoCert srl"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The shared client accepts caller-controlled doctor identifiers for read and write operations without requiring authentication or authorization credentials."
}
],
"value": "The shared client accepts caller-controlled doctor identifiers for read and write operations without requiring authentication or authorization credentials."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8,
"baseSeverity": "HIGH",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T11:49:12.134Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"url": "https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical"
},
{
"url": "https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "AIS PersonnelService client performs unauthenticated doctor-specific operations",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-118461",
"datePublished": "2026-11-09T11:49:12.134Z",
"dateReserved": "2026-10-28T08:46:25.411Z",
"dateUpdated": "2026-11-09T11:49:12.134Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118460 (GCVE-0-2026-118460)
Vulnerability from cvelistv5 – Published: 2026-11-09 11:48 – Updated: 2026-11-09 11:48
VLAI
EPSS
VEX
Title
AIS embedded private keys enable practitioner impersonation
Summary
Embedded private keys protected by a shared password can be used to sign practitioner assertions for arbitrary practitioner identifiers, enabling unauthorized practitioner token requests.
Severity
CWE
Assigner
ENISA
CNA
References
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| CompuGroup Medical | Infantia |
Affected:
0 , ≤ 6.09.1
(semver)
|
|
| CompuGroup Medical | Profim |
Affected:
0 , ≤ 6.09.1
(semver)
|
|
| CompuGroup Medical | Venere |
Affected:
0 , ≤ 6.09.1
(semver)
|
|
| CompuGroup Medical | Phronesis |
Affected:
0 , ≤ 6.09.1
(semver)
|
|
| CompuGroup Medical | Infantia |
Affected:
0 , ≤ 5.1.1
(semver)
|
|
| CompuGroup Medical | Profim |
Affected:
0 , ≤ 5.1.1
(semver)
|
|
| CompuGroup Medical | Venere |
Affected:
0 , ≤ 5.1.1
(semver)
|
|
| CompuGroup Medical | Phronesis |
Affected:
0 , ≤ 5.1.1
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"packageName": "cgm.it.ais.farmaci",
"product": "Infantia",
"vendor": "CompuGroup Medical",
"versions": [
{
"lessThanOrEqual": "6.09.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "cgm.it.ais.farmaci",
"product": "Profim",
"vendor": "CompuGroup Medical",
"versions": [
{
"lessThanOrEqual": "6.09.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "cgm.it.ais.farmaci",
"product": "Venere",
"vendor": "CompuGroup Medical",
"versions": [
{
"lessThanOrEqual": "6.09.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "cgm.it.ais.farmaci",
"product": "Phronesis",
"vendor": "CompuGroup Medical",
"versions": [
{
"lessThanOrEqual": "6.09.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "cgm.it.ais.common",
"product": "Infantia",
"vendor": "CompuGroup Medical",
"versions": [
{
"lessThanOrEqual": "5.1.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "cgm.it.ais.common",
"product": "Profim",
"vendor": "CompuGroup Medical",
"versions": [
{
"lessThanOrEqual": "5.1.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "cgm.it.ais.common",
"product": "Venere",
"vendor": "CompuGroup Medical",
"versions": [
{
"lessThanOrEqual": "5.1.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "cgm.it.ais.common",
"product": "Phronesis",
"vendor": "CompuGroup Medical",
"versions": [
{
"lessThanOrEqual": "5.1.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Marco Sala"
},
{
"lang": "en",
"type": "coordinator",
"value": "CSIRT-IT"
},
{
"lang": "en",
"type": "finder",
"value": "ApoCert srl"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Embedded private keys protected by a shared password can be used to sign practitioner assertions for arbitrary practitioner identifiers, enabling unauthorized practitioner token requests."
}
],
"value": "Embedded private keys protected by a shared password can be used to sign practitioner assertions for arbitrary practitioner identifiers, enabling unauthorized practitioner token requests."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8,
"baseSeverity": "HIGH",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-321",
"description": "CWE-321",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T11:48:31.899Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"url": "https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html"
},
{
"url": "https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "AIS embedded private keys enable practitioner impersonation",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-118460",
"datePublished": "2026-11-09T11:48:31.899Z",
"dateReserved": "2026-10-28T08:46:25.411Z",
"dateUpdated": "2026-11-09T11:48:31.899Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118459 (GCVE-0-2026-118459)
Vulnerability from cvelistv5 – Published: 2026-11-09 11:47 – Updated: 2026-11-09 11:47
VLAI
EPSS
VEX
Title
AIS PasswordSOS permits authentication without legitimate credentials
Summary
A time-derived emergency password can be derived from publicly available application code, enabling authentication without legitimate credentials.
Severity
CWE
Assigner
ENISA
CNA
References
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| CompuGroup Medical | Infantia |
Affected:
0 , ≤ 5.1.1
(semver)
|
|
| CompuGroup Medical | Profim |
Affected:
0 , ≤ 5.1.1
(semver)
|
|
| CompuGroup Medical | Venere |
Affected:
0 , ≤ 5.1.1
(semver)
|
|
| CompuGroup Medical | Phronesis |
Affected:
0 , ≤ 5.1.1
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"packageName": "cgm.it.ais.common",
"product": "Infantia",
"vendor": "CompuGroup Medical",
"versions": [
{
"lessThanOrEqual": "5.1.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "cgm.it.ais.common",
"product": "Profim",
"vendor": "CompuGroup Medical",
"versions": [
{
"lessThanOrEqual": "5.1.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "cgm.it.ais.common",
"product": "Venere",
"vendor": "CompuGroup Medical",
"versions": [
{
"lessThanOrEqual": "5.1.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "cgm.it.ais.common",
"product": "Phronesis",
"vendor": "CompuGroup Medical",
"versions": [
{
"lessThanOrEqual": "5.1.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Marco Sala"
},
{
"lang": "en",
"type": "coordinator",
"value": "CSIRT-IT"
},
{
"lang": "en",
"type": "finder",
"value": "ApoCert srl"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A time-derived emergency password can be derived from publicly available application code, enabling authentication without legitimate credentials."
}
],
"value": "A time-derived emergency password can be derived from publicly available application code, enabling authentication without legitimate credentials."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-640",
"description": "CWE-640",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T11:47:11.721Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"url": "https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html"
},
{
"url": "https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "AIS PasswordSOS permits authentication without legitimate credentials",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-118459",
"datePublished": "2026-11-09T11:47:11.721Z",
"dateReserved": "2026-10-28T08:46:25.411Z",
"dateUpdated": "2026-11-09T11:47:11.721Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118458 (GCVE-0-2026-118458)
Vulnerability from cvelistv5 – Published: 2026-11-09 11:46 – Updated: 2026-11-09 11:46
VLAI
EPSS
VEX
Title
AIS shared test login provider contains fixed administrative credentials
Summary
The shared AIS login routing selects a production-shipped test DAO and plaintext comparison for the H and V application codes, accepting fixed administrator accounts.
Severity
CWE
Assigner
ENISA
CNA
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| CompuGroup Medical | Phronesis |
Affected:
0 , ≤ 5.1.15.1.1
(semver)
|
|
| CompuGroup Medical | Venere |
Affected:
0 , ≤ 5.1.15.1.1
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"packageName": "cgm.it.ais.common",
"product": "Phronesis",
"vendor": "CompuGroup Medical",
"versions": [
{
"lessThanOrEqual": "5.1.15.1.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "cgm.it.ais.common",
"product": "Venere",
"vendor": "CompuGroup Medical",
"versions": [
{
"lessThanOrEqual": "5.1.15.1.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Marco Sala"
},
{
"lang": "en",
"type": "coordinator",
"value": "CSIRT-IT"
},
{
"lang": "en",
"type": "finder",
"value": "ApoCert srl"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe shared AIS login routing selects a production-shipped test DAO and plaintext comparison for the H and V application codes, accepting fixed administrator accounts.\u003c/p\u003e"
}
],
"value": "The shared AIS login routing selects a production-shipped test DAO and plaintext comparison for the H and V application codes, accepting fixed administrator accounts."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "CWE-798",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T11:46:22.642Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"url": "https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical"
},
{
"url": "https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "AIS shared test login provider contains fixed administrative credentials",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-118458",
"datePublished": "2026-11-09T11:46:22.642Z",
"dateReserved": "2026-10-28T08:46:23.510Z",
"dateUpdated": "2026-11-09T11:46:22.642Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118450 (GCVE-0-2026-118450)
Vulnerability from cvelistv5 – Published: 2026-11-09 11:45 – Updated: 2026-11-09 11:45
VLAI
EPSS
VEX
Title
Venere loads replaceable unsigned components from a writable installation location
Summary
Venere is installed outside Program Files and loads/registers unsigned components from locations where an unprivileged user may create files.
Severity
CWE
Assigner
ENISA
CNA
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| CompuGroup Medical | Venere |
Affected:
8.33.2
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Venere",
"vendor": "CompuGroup Medical",
"versions": [
{
"status": "affected",
"version": "8.33.2",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Marco Sala"
},
{
"lang": "en",
"type": "coordinator",
"value": "CSIRT-IT"
},
{
"lang": "en",
"type": "finder",
"value": "ApoCert srl"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eVenere is installed outside Program Files and loads/registers unsigned components from locations where an unprivileged user may create files.\u003c/p\u003e"
}
],
"value": "Venere is installed outside Program Files and loads/registers unsigned components from locations where an unprivileged user may create files."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-427",
"description": "CWE-427",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T11:45:38.620Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"url": "https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical"
},
{
"url": "https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Venere loads replaceable unsigned components from a writable installation location",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-118450",
"datePublished": "2026-11-09T11:45:38.620Z",
"dateReserved": "2026-10-28T08:46:23.509Z",
"dateUpdated": "2026-11-09T11:45:38.620Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112172 (GCVE-0-2026-112172)
Vulnerability from cvelistv5 – Published: 2026-11-09 11:38 – Updated: 2026-11-09 11:45
VLAI
EPSS
VEX
Title
Unauthenticated SQL Execution in XDent/XMedical Synchronization Infrastructure
Summary
CGM XDent and XMedical expose PHP synchronization endpoints that allow unauthenticated attackers to manipulate session variables and execute arbitrary SQL queries against backend MySQL databases.
Severity
CWE
- CWE-89 - Improper neutralization of special elements used in an SQL command ('SQL injection')
Assigner
ENISA
CNA
References
2 references
| URL | Tags |
|---|---|
| https://www.acn.gov.it/portale/w/rilevate-vulnera… | government-resource |
| https://www.cgm.com/ita_it/magazine/articles/comu… | government-resource |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| CompuGroup Medical | XDent |
Affected:
0 , < 4.4.0
(semver)
|
|
| CompuGroup Medical | XMedical |
Affected:
0 , < 4.4.0
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "XDent",
"vendor": "CompuGroup Medical",
"versions": [
{
"lessThan": "4.4.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "XMedical",
"vendor": "CompuGroup Medical",
"versions": [
{
"lessThan": "4.4.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Marco Sala"
},
{
"lang": "en",
"type": "coordinator",
"value": "CSIRT-IT"
},
{
"lang": "en",
"type": "finder",
"value": "ApoCert srl"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "CGM XDent and XMedical expose PHP synchronization endpoints that allow unauthenticated attackers to manipulate session variables and execute arbitrary SQL queries against backend MySQL databases."
}
],
"value": "CGM XDent and XMedical expose PHP synchronization endpoints that allow unauthenticated attackers to manipulate session variables and execute arbitrary SQL queries against backend MySQL databases."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "YES",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:Y",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper neutralization of special elements used in an SQL command (\u0027SQL injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T11:45:11.226Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical"
},
{
"tags": [
"government-resource"
],
"url": "https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html"
}
],
"title": "Unauthenticated SQL Execution in XDent/XMedical Synchronization Infrastructure",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-112172",
"datePublished": "2026-11-09T11:38:18.744Z",
"dateReserved": "2026-10-19T08:06:39.208Z",
"dateUpdated": "2026-11-09T11:45:11.226Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-48981 (GCVE-0-2025-48981)
Vulnerability from cvelistv5 – Published: 2025-10-08 00:49 – Updated: 2025-10-09 01:06
VLAI
EPSS
VEX
Summary
An insecure implementation of the proprietary protocol DNET in Product CGM MEDICO allows attackers within the intranet to eavesdrop and manipulate data on the protocol because encryption is optional for this connection.
Severity
8.6 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-10-08 13:18 UTC
CWE
- CWE-311 - Missing Encryption of Sensitive Data
Assigner
hackerone
CNA
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| CompuGroup Medical | CGM MEDICO |
Affected:
29.0 , < 29.1
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-48981",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-08T13:18:24.008524Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-311",
"description": "CWE-311 Missing Encryption of Sensitive Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-08T13:20:43.202Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "CGM MEDICO",
"vendor": "CompuGroup Medical",
"versions": [
{
"lessThan": "29.1",
"status": "affected",
"version": "29.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An insecure implementation of the proprietary protocol DNET in Product CGM MEDICO allows attackers within the intranet to eavesdrop and manipulate data on the protocol because encryption is optional for this connection."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-09T01:06:32.695Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://www.cgm.com/deu_de/allgemein/cybersecurity-en/security-advisoriy.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2025-48981",
"datePublished": "2025-10-08T00:49:16.646Z",
"dateReserved": "2025-05-29T15:00:04.773Z",
"dateUpdated": "2025-10-09T01:06:32.695Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}