Skip to content
OpenAdvisories

Product · CompuGroup Medical

Profim

9 known vulnerabilities.

Profim at a glance

Last 12 months
9
Critical · all time
1
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 5 10 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 9 vulnerabilities, 1 critical
Show as table
MonthVulnerabilitiesCritical
Nov 202691
Oct 202600
Sep 202600
Aug 202600
Jul 202600
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400
All Critical High Medium Low Exploited only Public exploit

9 results · Feed

  • Medium 5.9
    CVE-2026-118795

    AIS stores authorization state in locally modifiable databases

    Administrative roles and module permissions are stored in mutable local database fields, allowing privilege escalation for attackers with database write access.

    CompuGroup Medical Venere Profim Infantia
  • High 7.2
    CVE-2026-118468

    AIS XML parsers allow external entity resolution

    XML parsers process attacker-influenced update manifests or network responses with external entity resolution enabled, potentially allowing XML External Entity (XXE) attacks.

    CompuGroup Medical Venere Profim Infantia
  • Medium 4.3
    CVE-2026-118467

    AIS products expose clinical and personal data via logs and telemetry

    Shared telemetry and logging components store or transmit patient and doctor identifiers, clinical information, and low-entropy identifiers without adequate pseudonymization or protection.

    CompuGroup Medical Venere Phronesis Profim
  • Medium 5.8
    CVE-2026-118465

    AIS products use vendor-wide hard-coded database credentials

    Shared components expose hard-coded Access, workgroup, CCBasic, DBISAM, and related database credentials that are identical across installations.

    CompuGroup Medical Venere Phronesis Profim
  • Medium 5.8
    CVE-2026-118464

    AIS shared cryptographic services use fixed cryptographic secrets

    Shared cryptographic services use fixed vendor-wide secrets, deterministic IVs, null salts, and reversible transformations to protect credentials, IPC data, configuration values, and clinical fields.

    CompuGroup Medical Venere Infantia Phronesis
  • Critical 9.2
    CVE-2026-118462

    AIS update mechanism executes unverified code

    Update components download and execute code without proper authenticity verification, relying on ignored hashes or forgeable checksums. Some update paths also permit archive traversal or script execution.

    CompuGroup Medical Venere Infantia Phronesis
  • High 8.0
    CVE-2026-118461

    AIS PersonnelService client performs unauthenticated doctor-specific operations

    The shared client accepts caller-controlled doctor identifiers for read and write operations without requiring authentication or authorization credentials.

    CompuGroup Medical Venere Profim Infantia
  • High 8.0
    CVE-2026-118460

    AIS embedded private keys enable practitioner impersonation

    Embedded private keys protected by a shared password can be used to sign practitioner assertions for arbitrary practitioner identifiers, enabling unauthorized practitioner token requests.

    CompuGroup Medical Venere Phronesis Profim
  • Medium 6.3
    CVE-2026-118459

    AIS PasswordSOS permits authentication without legitimate credentials

    A time-derived emergency password can be derived from publicly available application code, enabling authentication without legitimate credentials.

    CompuGroup Medical Venere Phronesis Profim