CVE-2025-30040: Cgm Clininet

Critical severity, CVSS 9.0. EPSS: 0.2% chance of exploitation in the next 30 days.

The vulnerability allows unauthenticated users to download a file containing session ID data by directly accessing the "/cgi-bin/CliniNET.prd/utils/userlogxls.pl" endpoint.

Affected products

• Cgm Cgm Clininet: before 2024.MS4 (fixed in 2024.MS4)

Published 2025-08-27. Last modified 2026-06-17.