Vendor
CompuGroup Medical
17 known vulnerabilities.
CompuGroup Medical at a glance
- Last 12 months
- 16
- Critical · all time
- 1
- Exploited · all time
- 0
- Public exploit · all time
- 0
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 16 | 1 |
| Oct 2026 | 0 | 0 |
| Sep 2026 | 0 | 0 |
| Aug 2026 | 0 | 0 |
| Jul 2026 | 0 | 0 |
| Jun 2026 | 0 | 0 |
| May 2026 | 0 | 0 |
| Apr 2026 | 0 | 0 |
| Mar 2026 | 0 | 0 |
| Feb 2026 | 0 | 0 |
| Jan 2026 | 0 | 0 |
| Dec 2025 | 0 | 0 |
| Nov 2025 | 0 | 0 |
| Oct 2025 | 1 | 0 |
| Sep 2025 | 0 | 0 |
| Aug 2025 | 0 | 0 |
| Jul 2025 | 0 | 0 |
| Jun 2025 | 0 | 0 |
| May 2025 | 0 | 0 |
| Apr 2025 | 0 | 0 |
| Mar 2025 | 0 | 0 |
| Feb 2025 | 0 | 0 |
| Jan 2025 | 0 | 0 |
| Dec 2024 | 0 | 0 |
17 results · Feed
-
Medium 4.4
Multiple sensitive authentication data exposed
Multiple sensitive authentication data, including credentials, OAuth-related secrets, session information, and authentication artifacts, are exposed through application logs and persistent client-side storage, enabling unauthorized access and session compromi…
-
Medium 5.9
AIS stores authorization state in locally modifiable databases
Administrative roles and module permissions are stored in mutable local database fields, allowing privilege escalation for attackers with database write access.
-
Medium 6.1
Default ODBC credentials
Default credentials permit access through AcuXDBC.
-
High 7.2
Insecure software update mechanism
The application implements software update functionality without adequate authenticity and integrity validation, allowing update packages to be accepted without sufficient cryptographic verification.
-
High 7.2
Multiple Hardcoded Credentials
Multiple hardcoded credentials are embedded within product components and administrative functionalities. These credentials may enable unauthorized access to privileged accounts, services, or application features across affected deployments.
-
High 7.2
AIS XML parsers allow external entity resolution
XML parsers process attacker-influenced update manifests or network responses with external entity resolution enabled, potentially allowing XML External Entity (XXE) attacks.
-
Medium 4.3
AIS products expose clinical and personal data via logs and telemetry
Shared telemetry and logging components store or transmit patient and doctor identifiers, clinical information, and low-entropy identifiers without adequate pseudonymization or protection.
-
Medium 5.8
AIS products use vendor-wide hard-coded database credentials
Shared components expose hard-coded Access, workgroup, CCBasic, DBISAM, and related database credentials that are identical across installations.
-
Medium 5.8
AIS shared cryptographic services use fixed cryptographic secrets
Shared cryptographic services use fixed vendor-wide secrets, deterministic IVs, null salts, and reversible transformations to protect credentials, IPC data, configuration values, and clinical fields.
-
Critical 9.2
AIS update mechanism executes unverified code
Update components download and execute code without proper authenticity verification, relying on ignored hashes or forgeable checksums. Some update paths also permit archive traversal or script execution.
-
High 8.0
AIS PersonnelService client performs unauthenticated doctor-specific operations
The shared client accepts caller-controlled doctor identifiers for read and write operations without requiring authentication or authorization credentials.
-
High 8.0
AIS embedded private keys enable practitioner impersonation
Embedded private keys protected by a shared password can be used to sign practitioner assertions for arbitrary practitioner identifiers, enabling unauthorized practitioner token requests.
-
Medium 6.3
AIS PasswordSOS permits authentication without legitimate credentials
A time-derived emergency password can be derived from publicly available application code, enabling authentication without legitimate credentials.
-
High 8.1
AIS shared test login provider contains fixed administrative credentials
The shared AIS login routing selects a production-shipped test DAO and plaintext comparison for the H and V application codes, accepting fixed administrator accounts.
-
Medium 5.9
Venere loads replaceable unsigned components from a writable installation location
Venere is installed outside Program Files and loads/registers unsigned components from locations where an unprivileged user may create files.
-
High 8.1
Unauthenticated SQL Execution in XDent/XMedical Synchronization Infrastructure
CGM XDent and XMedical expose PHP synchronization endpoints that allow unauthenticated attackers to manipulate session variables and execute arbitrary SQL queries against backend MySQL databases.
-
High 8.6
An insecure implementation of the proprietary protocol DNET in Product CGM MEDICO allows attackers within the intranet …