News & Sicurezza

CVE ID : CVE-2025-14532 Published : March 2, 2026, 1:16 p.m. | 28 minutes ago Description : DobryCMS's upload file functionality allows an unauthenticated remote attacker to upload files of any type and extension without restriction, which can result in Remote Code Execution. This issue was fixed in versions above 5.0. Severity: 9.3 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2025-12462 Published : March 2, 2026, 1:16 p.m. | 28 minutes ago Description : A Blind SQL injection vulnerability has been identified in DobryCMS. A remote unauthenticated attacker is able to inject SQL syntax into URL path resulting in Blind SQL Injection. This issue was fixed in versions above 8.0. Severity: 9.3 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Vulnerabilities in DobryCMS software Vulnerabilities in DobryCMS software CVE ID CVE-2025-12462 Publication date 02 March 2026 Vendor Studio Fabryka Product DobryCMS Vulnerable versions Up to 8.0 Vulnerability type (CWE) Improper Neutral ... Read more Published Date: Mar 02, 2026 (22 hours, 50 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2025-14532 CVE-2025-12462

Hackers Attacking SonicWall Firewalls from 4,000+ unique IP Addresses to Exploit Vulnerabilities A large-scale reconnaissance campaign is actively targeting SonicWall firewalls across the internet, with attackers using more than 4,000 unique IP addresses to map vulnerable devices before launching ... Read more Published Date: Mar 02, 2026 (23 hours, 18 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2024-53704 CVE-2021-20028 CVE-2019-7481

CVE ID : CVE-2025-58406 Published : March 2, 2026, 12:16 p.m. | 1 hour, 28 minutes ago Description : The CGM CLININET application respond without essential security HTTP headers, exposing users to client‑side attacks such as clickjacking, MIME sniffing, unsafe caching, weak cross‑origin isolation, and missing transport security controls. Severity: 5.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2025-58405 Published : March 2, 2026, 12:16 p.m. | 1 hour, 28 minutes ago Description : The CGM CLININET application does not implement any mechanisms that prevent clickjacking attacks, neither HTTP security headers nor HTML-based frame‑busting protections were detected. As a result, an attacker can embed the application inside a maliciously crafted IFRAME and trick users into performing unintended actions, including potentially bypassing CSRF/XSRF defenses. Severity: 5.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2025-58402 Published : March 2, 2026, 12:16 p.m. | 1 hour, 28 minutes ago Description : The CGM CLININET application uses direct, sequential object identifiers "MessageID" without proper authorization checks. By modifying the parameter in the GET request, an attacker can access messages and attachments belonging to other users. Severity: 7.1 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2025-30062 Published : March 2, 2026, 12:16 p.m. | 1 hour, 28 minutes ago Description : In the "CheckUnitCodeAndKey.pl" service, the "validateOrgUnit" function is vulnerable to SQL injection. Severity: 6.9 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2025-30044 Published : March 2, 2026, 12:16 p.m. | 1 hour, 28 minutes ago Description : In the endpoints "/cgi-bin/CliniNET.prd/utils/usrlogstat_simple.pl", "/cgi-bin/CliniNET.prd/utils/usrlogstat.pl", "/cgi-bin/CliniNET.prd/utils/userlogstat2.pl", and "/cgi-bin/CliniNET.prd/utils/dblogstat.pl", the parameters are not sufficiently normalized, which enables code injection. Severity: 9.4 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2025-30042 Published : March 2, 2026, 12:16 p.m. | 1 hour, 28 minutes ago Description : The CGM CLININET system provides smart card authentication; however, authentication is conducted locally on the client device, and, in reality, only the certificate number is used for access verification. As a result, possession of the certificate number alone is sufficient for authentication, regardless of the actual presence of the smart card or ownership of the private key. Severity: 9.0 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2025-30035 Published : March 2, 2026, 12:16 p.m. | 1 hour, 28 minutes ago Description : The vulnerability enables an attacker to fully bypass authentication in CGM CLININET and gain access to any active user account by supplying only the username, without requiring a password or any other credentials. Obtaining a session ID is sufficient for session takeover and grants access to the system with the privileges of the targeted user. Severity: 9.0 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2025-10350 Published : March 2, 2026, 12:15 p.m. | 1 hour, 29 minutes ago Description : SQL Injection vulnerability in "imageserver" module when processing C-FIND queries in CGM NETRAAD software allows attacker connected to PACS gaining access to database, including data processed by GCM CLININET software.This issue affects CGM NETRAAD with imageserver module in versions before 7.9.0. Severity: 8.8 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...