{"id":"CVE-2025-30050","published":"2026-10-23T09:17:04.810","lastModified":"2026-10-23T16:28:32.357","description":"CGM CLININET is vulnerable to Code Injection in the RunCGI.pm component, which dynamically imports the module specified as a query parameter and executes code from untrusted data provided by the user. An attacker from adjacent network can supply a crafted query parameter to have an attacker-controlled module imported which results in arbitrary code execution with root privileges.\n\n\nThis issue was fixed in version 2026.MS3","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-94"],"vendors":[],"products":[],"references":[{"url":"https://cert.pl/en/posts/2026/10/CVE-2025-30043/","tags":[]},{"url":"https://www.cgm.com/pol_pl/products/szpital/cgm-clininet.html","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}