CompuGroup Medical vulnerabilities
We track 9 vulnerabilities in CompuGroup Medical products across 8 products. 9 are rated high or critical, and none are known to be exploited. The most recent was published on November 9, 2026.
Latest CompuGroup Medical vulnerabilities
- 7.2 High severity
Wingesfar: Download of Code Without Integrity Check
The application implements software update functionality without adequate authenticity and integrity validation, allowing update packages to be accepted without sufficient cryptographic verification.
- 7.2 High severity
Wingesfar: Use of Hard-coded Credentials
Multiple hardcoded credentials are embedded within product components and administrative functionalities. These credentials may enable unauthorized access to privileged accounts, services, or application features across affected deployments.
- 7.2 High severity
Infantia: Improper Restriction of XML External Entity Reference
XML parsers process attacker-influenced update manifests or network responses with external entity resolution enabled, potentially allowing XML External Entity (XXE) attacks.
- 9.2 Critical severity
Infantia: Download of Code Without Integrity Check
Update components download and execute code without proper authenticity verification, relying on ignored hashes or forgeable checksums. Some update paths also permit archive traversal or script execution.
- 8.0 High severity
Infantia: Missing Authentication for Critical Functionality
The shared client accepts caller-controlled doctor identifiers for read and write operations without requiring authentication or authorization credentials.
- 8.0 High severity
Infantia: Use of Hard-coded Cryptographic Key
Embedded private keys protected by a shared password can be used to sign practitioner assertions for arbitrary practitioner identifiers, enabling unauthorized practitioner token requests.
- 8.1 High severity
Phronesis: Use of Hard-coded Credentials
The shared AIS login routing selects a production-shipped test DAO and plaintext comparison for the H and V application codes, accepting fixed administrator accounts.
- 8.1 High severity
XDent: Improper Neutralization of Special Elements used in an SQL Command
CGM XDent and XMedical expose PHP synchronization endpoints that allow unauthenticated attackers to manipulate session variables and execute arbitrary SQL queries against backend MySQL databases.
- 8.6 High severity
CGM MEDICO: Missing Encryption of Sensitive Data
An insecure implementation of the proprietary protocol DNET in Product CGM MEDICO allows attackers within the intranet to eavesdrop and manipulate data on the protocol because encryption is optional for this connection.