# CGM vulnerabilities Source: https://junglewise.ai/threats/vendors/cgm Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/cgm.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 11 vulnerabilities in CGM: 0 in the last 7 days and 11 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2025-58403, was published on 23 October 2026. 11 vulnerabilities in the last four weeks, up from none in the four before. 1 technology has a page of its own. ## Counts - Last 7 days: 0 - Last 30 days: 11 - Last 90 days: 11 - All time: 11 (0 critical, 0 exploited in the wild) ## About CGM CGM is a healthcare software vendor. ## Latest CGM vulnerabilities - [CVE-2025-58403: CGM CLININET reflected cross-site scripting (XSS)](https://junglewise.ai/threats/cve-2025-58403-cgm-clininet-is-vulnerable-to-reflected-cross-site-scripting-xss) (info, published 23 Oct 2026) - [CVE-2025-30054: CGM CLININET privilege escalation in HL7 message processing](https://junglewise.ai/threats/cve-2025-30054-cgm-clininet-is-vulnerable-to-local-privilege-escalation-the) (info, published 23 Oct 2026) - [CVE-2025-30053: CGM CLININET cgm-updater missing authentication on open port](https://junglewise.ai/threats/cve-2025-30053-the-cgm-clininet-application-runs-the-cgm-updater-process) (info, published 23 Oct 2026) - [CVE-2025-30052: CGM CLININET rsyncd authentication bypass via IP spoofing](https://junglewise.ai/threats/cve-2025-30052-the-rsyncd-service-of-the-cgm-clininet-is-vulnerable-to) (info, published 23 Oct 2026) - [CVE-2025-30051: CGM CLININET insecure file permissions expose database credentials](https://junglewise.ai/threats/cve-2025-30051-the-cgm-clininet-application-stores-the-production-database-login) (info, published 23 Oct 2026) - [CVE-2025-30050: CGM CLININET code injection in RunCGI.pm](https://junglewise.ai/threats/cve-2025-30050-cgm-clininet-is-vulnerable-to-code-injection-in-the-runcgi-pm) (info, published 23 Oct 2026) - [CVE-2025-30049: CGM CLININET weak password hashing using MD5](https://junglewise.ai/threats/cve-2025-30049-the-cgm-clininet-application-stores-user-passwords-as-unsalted) (info, published 23 Oct 2026) - [CVE-2025-30047: CGM CLININET unsafe Java deserialization remote code execution](https://junglewise.ai/threats/cve-2025-30047-cgm-clininet-is-vulnerable-to-remote-code-execution-caused-by) (info, published 23 Oct 2026) - [CVE-2025-30046: CGM CLININET privileged code execution in HL7 handler](https://junglewise.ai/threats/cve-2025-30046-in-the-cgm-clininet-application-server-multiple-processes) (info, published 23 Oct 2026) - [CVE-2025-30045: CGM CLININET code injection in ConvExpr function](https://junglewise.ai/threats/cve-2025-30045-cgm-clininet-is-vulnerable-to-code-injection-in-the-convexpr) (info, published 23 Oct 2026) - [CVE-2025-30043: CGM CLININET missing authentication in /DocManagment path](https://junglewise.ai/threats/cve-2025-30043-cgm-clininet-is-vulnerable-to-missing-authentication-for-critical) (info, published 23 Oct 2026) ## Most severe CGM vulnerabilities - [CVE-2025-58403: CGM CLININET reflected cross-site scripting (XSS)](https://junglewise.ai/threats/cve-2025-58403-cgm-clininet-is-vulnerable-to-reflected-cross-site-scripting-xss) (info, published 23 Oct 2026) - [CVE-2025-30054: CGM CLININET privilege escalation in HL7 message processing](https://junglewise.ai/threats/cve-2025-30054-cgm-clininet-is-vulnerable-to-local-privilege-escalation-the) (info, published 23 Oct 2026) - [CVE-2025-30053: CGM CLININET cgm-updater missing authentication on open port](https://junglewise.ai/threats/cve-2025-30053-the-cgm-clininet-application-runs-the-cgm-updater-process) (info, published 23 Oct 2026) - [CVE-2025-30052: CGM CLININET rsyncd authentication bypass via IP spoofing](https://junglewise.ai/threats/cve-2025-30052-the-rsyncd-service-of-the-cgm-clininet-is-vulnerable-to) (info, published 23 Oct 2026) - [CVE-2025-30051: CGM CLININET insecure file permissions expose database credentials](https://junglewise.ai/threats/cve-2025-30051-the-cgm-clininet-application-stores-the-production-database-login) (info, published 23 Oct 2026) - [CVE-2025-30050: CGM CLININET code injection in RunCGI.pm](https://junglewise.ai/threats/cve-2025-30050-cgm-clininet-is-vulnerable-to-code-injection-in-the-runcgi-pm) (info, published 23 Oct 2026) - [CVE-2025-30049: CGM CLININET weak password hashing using MD5](https://junglewise.ai/threats/cve-2025-30049-the-cgm-clininet-application-stores-user-passwords-as-unsalted) (info, published 23 Oct 2026) - [CVE-2025-30047: CGM CLININET unsafe Java deserialization remote code execution](https://junglewise.ai/threats/cve-2025-30047-cgm-clininet-is-vulnerable-to-remote-code-execution-caused-by) (info, published 23 Oct 2026) - [CVE-2025-30046: CGM CLININET privileged code execution in HL7 handler](https://junglewise.ai/threats/cve-2025-30046-in-the-cgm-clininet-application-server-multiple-processes) (info, published 23 Oct 2026) - [CVE-2025-30045: CGM CLININET code injection in ConvExpr function](https://junglewise.ai/threats/cve-2025-30045-cgm-clininet-is-vulnerable-to-code-injection-in-the-convexpr) (info, published 23 Oct 2026) ## Vulnerabilities per week 11 vulnerabilities in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 11 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## CGM technologies - [CGM CLININET](https://junglewise.ai/threats/technologies/clininet): 11 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "CGM vulnerabilities", https://junglewise.ai/threats/vendors/cgm, 9 November 2026.