rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-30013 Code Injection vulnerability in SAP ERP BW Business Content
SAP ERP BW Business Content is vulnerable to OS Command Injection through certain function modules. These function modules, when executed with elevated privileges, improperly handle user input, allowing attacker to inject arbitrary OS commands. This vulnerability allows the execution of unintended commands on the underlying system, posing a significant security risk to the confidentiality, integrity and availability of the application.
Problem types: cwe_id: CWE-94
description: CWE-94: Improper Control of Generation of Code
Affected products: vendor: SAP_SE
product: SAP ERP BW Business Content
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2025-04-08T07:14:07.797Z
CVE-2025-30014 Directory Traversal vulnerability in SAP Capital Yield Tax Management
SAP Capital Yield Tax Management has directory traversal vulnerability due to insufficient path validation. This could allow an attacker with low privileges to read files from directory which they don�t have access to, hence causing a high impact on confidentiality. Integrity and Availability are not affected.
Problem types: cwe_id: CWE-35
description: CWE-35: Path Traversal
Affected products: vendor: SAP_SE
product: SAP Capital Yield Tax Management
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
version: 3.1
Published: 2025-04-08T07:14:25.929Z
CVE-2025-30015 Memory Corruption vulnerability in SAP NetWeaver and ABAP Platform (Application Server ABAP)
Due to incorrect memory address handling in ABAP SQL of SAP NetWeaver and ABAP Platform (Application Server ABAP), an authenticated attacker with high privileges could execute certain forms of SQL queries leading to manipulation of content in the output variable. This vulnerability has a low impact on the confidentiality, integrity and the availability of the application.
Problem types: cwe_id: CWE-787
description: CWE-787: Out-of-bounds Write
Affected products: vendor: SAP_SE
product: SAP NetWeaver and ABAP Platform (Application Server ABAP)
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 4.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Published: 2025-04-08T07:14:37.019Z
CVE-2025-30016 Authentication Bypass Vulnerability in SAP Financial Consolidation
SAP Financial Consolidation allows an unauthenticated attacker to gain unauthorized access to the Admin account. The vulnerability arises due to improper authentication mechanisms, due to which there is high impact on the Confidentiality, Integrity & Availability of the application.
Problem types: cwe_id: CWE-921
description: CWE-921: Storage of Sensitive Data in a Mechanism without Access Control
Affected products: vendor: SAP_SE
product: SAP Financial Consolidation
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2025-04-08T07:14:51.578Z
CVE-2025-30017 Missing Authorization check in SAP Solution Manager
Due to a missing authorization check, an authenticated attacker could upload a file as a template for solution documentation in SAP Solution Manager 7.1. After successful exploitation, an attacker can cause limited impact on the integrity and availability of the application.
Problem types: cwe_id: CWE-862
description: CWE-862: Missing Authorization
Affected products: vendor: SAP_SE
product: SAP Solution Manager
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 4.4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
version: 3.1
Published: 2025-04-08T07:15:02.720Z
CVE-2025-30018 Multiple vulnerabilities in SAP Supplier Relationship Management (Live Auction Cockpit)
The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) allows an unauthenticated attacker to submit an application servlet request with a crafted XML file which when parsed, enables the attacker to access sensitive files and data. This vulnerability has a high impact on the application's confidentiality, with no effect on integrity and availability of the application.
Problem types: cwe_id: CWE-611
description: CWE-611: Improper Restriction of XML External Entity Reference
Affected products: vendor: SAP_SE
product: SAP Supplier Relationship Management (Live Auction Cockpit)
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.6
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
version: 3.1
Published: 2025-05-13T00:16:20.584Z
CVE-2025-30022 
CM Soluces Informatica Ltda Auto Atendimento 1.x.x was discovered to contain a SQL injection via the DATANASC parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-14T00:00:00.000Z
CVE-2025-30023 
The communication protocol used between client and server had a flaw that could lead to an authenticated user performing a remote code execution attack.
Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: Axis Communications AB
product: AXIS Camera Station Pro
default_status: unaffected
vendor: Axis Communications AB
product: AXIS Camera Station
default_status: unaffected
vendor: Axis Communications AB
product: AXIS Device Manager
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 9
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Noam Moshe of Claroty Team82
Published: 2025-07-11T06:02:00.620Z
CVE-2025-30024 
The communication protocol used between client
and server had a flaw that could be leveraged to execute a man in the middle attack.
Problem types: cwe_id: CWE-295
description: CWE-295 Improper Certificate Validation
Affected products: vendor: Axis Communications AB
product: AXIS Device Manager
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: Noam Moshe of Claroty Team82
Published: 2025-07-11T06:03:29.926Z
CVE-2025-30025 
The communication protocol used between the
server process and the service control had a flaw that could lead to a local privilege escalation.
Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: Axis Communications AB
product: AXIS Device Manager
default_status: unaffected
vendor: Axis Communications AB
product: AXIS Camera Station Pro
default_status: unaffected
vendor: Axis Communications AB
product: AXIS Camera Station
default_status: unaffected
Credits: lang: en
value: Noam Moshe of Claroty Team82
Published: 2025-07-11T06:04:40.972Z
CVE-2025-30026 
The AXIS Camera Station Server had a flaw that allowed
to bypass authentication that is normally required.
Problem types: cwe_id: CWE-288
description: CWE-288: Authentication Bypass Using an Alternate Path or Channel
Affected products: vendor: Axis Communications AB
product: AXIS Camera Station Pro
default_status: unaffected
vendor: Axis Communications AB
product: AXIS Camera Station
default_status: unaffected
Credits: lang: en
value: Noam Moshe of Claroty Team82
Published: 2025-07-11T06:05:33.887Z
CVE-2025-30027 
An ACAP configuration file lacked sufficient input validation, which could allow for arbitrary code execution. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.
Problem types: cwe_id: CWE-1287
description: CWE-1287: Improper Validation of Specified Type of Input
Affected products: vendor: Axis Communications AB
product: AXIS OS
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: URCQ
Published: 2025-08-12T05:18:26.937Z
CVE-2025-30028 
A vulnerability in Active Backup for Business allows unauthorized remote attackers to read arbitrary files.
Problem types: cwe_id: CWE-89
description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Synology
product: Active Backup for Business
default_status: affected
CVSS v3.1: baseScore: 8.6
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
version: 3.1
Credits: lang: en
value: PSIRT
Published: 2026-05-27T08:40:46.699Z
CVE-2025-30030 
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'ImportDatabase' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on. (ZDI-CAN-25924)
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Siemens
product: TeleControl Server Basic
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
baseScore: 8.8
baseSeverity: HIGH
Published: 2025-04-16T17:37:31.712Z
CVE-2025-30031 
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'UpdateUsers' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on. (ZDI-CAN-25922)
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Siemens
product: TeleControl Server Basic
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
baseScore: 8.8
baseSeverity: HIGH
Published: 2025-04-16T17:37:33.194Z
CVE-2025-30032 
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'UpdateDatabaseSettings' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on. (ZDI-CAN-25921)
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Siemens
product: TeleControl Server Basic
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
baseScore: 8.8
baseSeverity: HIGH
Published: 2025-04-16T17:37:34.628Z
CVE-2025-30034 
A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V3.3). Affected devices do not properly validate input sent to its listening port on the local loopback interface. This could allow an unauthenticated local attacker to cause a denial of service condition.
Problem types: cwe_id: CWE-617
description: CWE-617: Reachable Assertion
Affected products: vendor: Siemens
product: SIMATIC RTLS Locating Manager
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
baseScore: 6.2
baseSeverity: MEDIUM
Published: 2025-08-12T11:16:58.223Z
CVE-2025-30035 Lack of API authentication allowing session generation for any user
The vulnerability enables an attacker to fully bypass authentication in CGM CLININET and gain access to any active user account by supplying only the username, without requiring a password or any other credentials. Obtaining a session ID is sufficient for session takeover and grants access to the system with the privileges of the targeted user.
Problem types: cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: CGM
product: CGM CLININET
default_status: unaffected
Credits: lang: en
value: Maciej Kazulak
Published: 2026-03-02T11:14:05.568Z
CVE-2025-30036 Stored XSS permitting session takeover of arbitrary user
Stored XSS vulnerability exists in the "Oddział" (Ward) module, in the death diagnosis description field, and allows the execution of arbitrary JavaScript code. This can lead to session hijacking of other users and potentially to privilege escalation up to full administrative rights.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: CGM
product: CGM CLININET
default_status: unaffected
Credits: lang: en
value: Maciej Kazulak
Published: 2025-08-27T10:19:41.153Z
CVE-2025-30037 Missing authentication in APIs allowing data retrieval and modification
The system exposes several endpoints, typically including "/int/" in their path, that should be restricted to internal services, but are instead publicly accessible without authentication to any host able to reach the application server on port 443/tcp.
Problem types: cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: CGM
product: CGM CLININET
default_status: unaffected
Credits: lang: en
value: Maciej Kazulak
Published: 2025-08-27T10:20:18.040Z
CVE-2025-30038 Session ID leakage in Zone.Identifier of downloaded files
The vulnerability consists of a session ID leak when saving a file downloaded from CGM CLININET. The identifier is exposed through a built-in Windows security feature that stores additional metadata in an NTFS alternate data stream (ADS) for all files downloaded from potentially untrusted sources.
Problem types: cwe_id: CWE-1230
description: CWE-1230 Exposure of Sensitive Information Through Metadata
Affected products: vendor: CGM
product: CGM CLININET
default_status: unaffected
Credits: lang: en
value: Maciej Kazulak
Published: 2025-08-27T10:20:35.633Z
CVE-2025-30039 Missing authentication in API returning a list of all active sessions
Unauthenticated access to the "/cgi-bin/CliniNET.prd/GetActiveSessions.pl" endpoint allows takeover of any user session logged into the system, including users with admin privileges.
Problem types: cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: CGM
product: CGM CLININET
default_status: unaffected
Credits: lang: en
value: Maciej Kazulak
Published: 2025-08-27T10:20:57.386Z
CVE-2025-30040 Missing authentication in API returning request logs containing session IDs
The vulnerability allows unauthenticated users to download a file containing session ID data by directly accessing the "/cgi-bin/CliniNET.prd/utils/userlogxls.pl" endpoint.
Problem types: cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: CGM
product: CGM CLININET
default_status: unaffected
Credits: lang: en
value: Maciej Kazulak
Published: 2025-08-27T10:21:17.049Z
CVE-2025-30041 Missing authentication in APIs returning statistical data along with session IDs
The paths "/cgi-bin/CliniNET.prd/utils/userlogstat.pl", "/cgi-bin/CliniNET.prd/utils/usrlogstat.pl", and "/cgi-bin/CliniNET.prd/utils/dblogstat.pl" expose data containing session IDs.
Problem types: cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: CGM
product: CGM CLININET
default_status: unaffected
Credits: lang: en
value: Maciej Kazulak
Published: 2025-08-27T10:21:41.896Z
CVE-2025-30042 Session generation possible with certificate number only
The CGM CLININET system provides smart card authentication; however, authentication is conducted locally on the client device, and, in reality, only the certificate number is used for access verification. As a result, possession of the certificate number alone is sufficient for authentication, regardless of the actual presence of the smart card or ownership of the private key.
Problem types: cwe_id: CWE-603
description: CWE-603 Use of Client-Side Authentication
Affected products: vendor: CGM
product: CGM CLININET
default_status: unaffected
Credits: lang: en
value: Maciej Kazulak
Published: 2026-03-02T11:14:46.946Z
CVE-2025-30044 RCE on uhcapache user permissions
In the endpoints "/cgi-bin/CliniNET.prd/utils/usrlogstat_simple.pl", "/cgi-bin/CliniNET.prd/utils/usrlogstat.pl", "/cgi-bin/CliniNET.prd/utils/userlogstat2.pl", and "/cgi-bin/CliniNET.prd/utils/dblogstat.pl", the parameters are not sufficiently normalized, which enables code injection.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS CommandInjection')
Affected products: vendor: CGM
product: CGM CLININET
default_status: unaffected
Credits: lang: en
value: Maciej Kazulak
Published: 2026-03-02T11:15:43.754Z
CVE-2025-30048 Unauthenticated access to module configuration endpoint
The "serverConfig" endpoint, which returns the module configuration including credentials, is accessible without authentication.
Problem types: cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: CGM
product: CGM CLININET
default_status: unaffected
Credits: lang: en
value: Maciej Kazulak
Published: 2025-08-27T10:22:14.990Z
CVE-2025-30055 Conditional RCE via the "system" function
The "system" function receives untrusted input from the user. If the "EnableJSCaching" option is enabled, it is possible to execute arbitrary code provided as the "Module" parameter.
Problem types: cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: CGM
product: CGM CLININET
default_status: unaffected
Credits: lang: en
value: Maciej Kazulak
Published: 2025-08-27T10:22:41.893Z
CVE-2025-30056 Calling system commands via RunCommand
The RunCommand function accepts any parameter, which is then passed for execution in the shell. This allows an attacker to execute arbitrary code on the system.
Problem types: cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: CGM
product: CGM CLININET
default_status: unaffected
Credits: lang: en
value: Maciej Kazulak
Published: 2025-08-27T10:23:17.397Z
CVE-2025-30057 Authenticated RCE with uhcapache privileges in ConvertToPDF
In UHCRTFDoc, the filename parameter can be exploited to execute arbitrary code via command injection into the system() call in the ConvertToPDF function.
Problem types: cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: CGM
product: CGM CLININET
default_status: unaffected
Credits: lang: en
value: Maciej Kazulak
Published: 2025-08-27T10:23:38.269Z
CVE-2025-30058 SQL injection in getPatientIdentifier function of PatientService.pl
In the PatientService.pl service, the "getPatientIdentifier" function is vulnerable to SQL injection through the "pesel" parameter.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: CGM
product: CGM CLININET
default_status: unaffected
Credits: lang: en
value: Maciej Kazulak
Published: 2025-08-27T10:24:03.128Z
CVE-2025-30059 Authenticated SQL injection in PrepareCDExportJSON.pl
In the PrepareCDExportJSON.pl service, the "getPerfServiceIds" function is vulnerable to SQL injection.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: CGM
product: CGM CLININET
default_status: unaffected
Credits: lang: en
value: Maciej Kazulak
Published: 2025-08-27T10:24:27.151Z
CVE-2025-30060 SQL injection in ReturnUserUnitsXML.pl via the UserID parameter
In the ReturnUserUnitsXML.pl service, the "getUserInfo" function is vulnerable to SQL injection through the "UserID" parameter.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: CGM
product: CGM CLININET
default_status: unaffected
Credits: lang: en
value: Maciej Kazulak
Published: 2025-08-27T10:24:45.586Z
CVE-2025-30061 SQL injection in utils/Reporter/OpenReportWindow.pl via the UserID parameter
In the "utils/Reporter/OpenReportWindow.pl" service, there is an SQL injection vulnerability through the "UserID" parameter.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: CGM
product: CGM CLININET
default_status: unaffected
Credits: lang: en
value: Maciej Kazulak
Published: 2025-08-27T10:24:56.031Z
CVE-2025-30062 SQL injection in CheckUnitCodeAndKey.pl
In the "CheckUnitCodeAndKey.pl" service, the "validateOrgUnit" function is vulnerable to SQL injection.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: CGM
product: CGM CLININET
default_status: unaffected
Credits: lang: en
value: Maciej Kazulak
Published: 2026-03-02T11:16:16.043Z
CVE-2025-30063 Excessive permissions on configuration files containing database logins and passwords
The configuration file containing database logins and passwords is readable by any local user.
Problem types: cwe_id: CWE-732
description: CWE-732 Incorrect Permission Assignment for Critical Resource
Affected products: vendor: CGM
product: CGM CLININET
default_status: unaffected
Credits: lang: en
value: Maciej Kazulak
Published: 2025-08-27T10:25:02.678Z