CompuGroup Medical vulnerabilities
Every vulnerability this feed holds for CompuGroup Medical, merged from five public registers and ordered by what warrants attention first — exploited in the wild, then CVSS, then recency.
16 vulnerabilities tracked.
- 9.2 Update components download and execute code without proper authenticity verification, relying on ignored hashes or forgeable checksums.
- 8.1 The shared AIS login routing selects a production-shipped test DAO and plaintext comparison for the H and V application codes, accepting…
- 8.1 CGM XDent and XMedical expose PHP synchronization endpoints that allow unauthenticated attackers to manipulate session variables and…
- 8.0 The shared client accepts caller-controlled doctor identifiers for read and write operations without requiring authentication or…
- 8.0 Embedded private keys protected by a shared password can be used to sign practitioner assertions for arbitrary practitioner identifiers,…
- 7.2 The application implements software update functionality without adequate authenticity and integrity validation, allowing update packages…
- 7.2 Multiple hardcoded credentials are embedded within product components and administrative functionalities.
- 7.2 XML parsers process attacker-influenced update manifests or network responses with external entity resolution enabled, potentially allowing…
- 6.3 A time-derived emergency password can be derived from publicly available application code, enabling authentication without legitimate…
- 6.1 Default credentials permit access through AcuXDBC.
- 5.9 Administrative roles and module permissions are stored in mutable local database fields, allowing privilege escalation for attackers with…
- 5.9 Venere is installed outside Program Files and loads/registers unsigned components from locations where an unprivileged user may create…
- 5.8 Shared components expose hard-coded Access, workgroup, CCBasic, DBISAM, and related database credentials that are identical across…
- 5.8 Shared cryptographic services use fixed vendor-wide secrets, deterministic IVs, null salts, and reversible transformations to protect…
- 4.4 Multiple sensitive authentication data, including credentials, OAuth-related secrets, session information, and authentication artifacts,…
- 4.3 Shared telemetry and logging components store or transmit patient and doctor identifiers, clinical information, and low-entropy identifiers…
What this covers
This feed accumulates forward from the day it started storing records, and a name search that finds nothing here is also looked up against the registers directly — so an older advisory resolves even when it predates the corpus. It is still a reading view, not a substitute for the vendor's own advisory, and absence from this page is not a statement that CompuGroup Medical is free of vulnerabilities.
Query this from an agent over MCP · Check a lockfile by version
Other vendors tracked here
Linux Red Hat IBM Microsoft Apple Apache Software Foundation Google n/a Oracle Corporation zephyrproject Unknown FFMPEG JetBrains OpenEMR Drupal SAP_SE Cisco go-vikunja Eclipse Foundation hickory-dns n8n-io Hitachi Samsung Semiconductor Tanium